PT-2026-20325 · Rack+3 · Rack+3

Thesmartshadow · Published 2026-01-01 · Updated 2026-04-17 · CVE-2026-25500

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.22 Rack versions prior to 3.1.20 Rack versions prior to 3.2.5

Description Rack’s Rack::Directory component generates HTML directory indexes with clickable links for each file entry. If a file exists with a basename starting with the javascript: scheme (for example, javascript:alert(1)), the generated index includes an anchor with an href attribute set to that scheme. Clicking this link executes JavaScript in the browser. This results in a client-side cross-site scripting (XSS) condition in directory listings generated by Rack::Directory. The issue occurs because the file basename is directly inserted into the href attribute without validation or normalization. The vulnerable component is Rack::Directory.

Recommendations Update to Rack version 2.2.22 or later. Update to Rack version 3.1.20 or later. Update to Rack version 3.2.5 or later. Avoid exposing user-controlled directories via Rack::Directory. Apply a strict Content Security Policy (CSP) to reduce the impact of potential client-side execution issues. Restrict or sanitize uploaded filenames to disallow dangerous URI scheme prefixes.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-07220

CLEANSTART-2026-GE08280

CLEANSTART-2026-IW08736

CLEANSTART-2026-RZ30606

CLEANSTART-2026-XJ84245

CVE-2026-25500

GHSA-WHRJ-4476-WVMP

MGASA-2026-0075

OPENSUSE-SU-2026:10286-1

USN-8066-1

Affected Products

Linuxmint

Rack

Red Os

Ubuntu

References · 125

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25500.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-25500.yml · Exploit
• https://github.com/rack/rack/commit/f2f225f297b99fbee3d9f51255d41f601fc40aff · Patch
• https://github.com/rack/rack/security/advisories/GHSA-whrj-4476-wvmp · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-25500 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2026-0075.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61726 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-67130 · Security Note
• https://ubuntu.com/security/CVE-2026-22860 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8066-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25500 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-25500 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-25500 · Security Note
• https://osv.dev/vulnerability/GHSA-whrj-4476-wvmp · Vendor Advisory
• https://osv.dev/vulnerability/USN-8066-1 · Vendor Advisory