What’s Vulnerable › Vulnerabilities

CVE-2019-18978: The rack-cors rubygem may allow directory traveral

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-11-14 · updated 2026-06-17
• Weakness: CWE-22

Description

An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.

Affected products

• Canonical Ubuntu Linux: 16.04
• Debian Linux: 8.0, 9.0, 10.0
• Rack-Cors Project Rack-Cors: before 1.0.4 — fixed in 1.0.4
• Rubygems Rack-Cors: before 1.0.4; 0.1.0, 0.1.1, 0.2.0, 0.2.2, 0.2.4, 0.2.5 (+12) — fixed in 1.0.4

How to fix

Upgrade to a fixed version: Rack-Cors Project Rack-Cors 1.0.4; Rubygems Rack-Cors 1.0.4. Check the vendor advisory for mitigations.

References

• https://github.com/cyu/rack-cors/commit/e4d4fc362a4315808927011cbe5afcfe5486f17d
• https://github.com/cyu/rack-cors/compare/v1.0.3...v1.0.4
• https://lists.debian.org/debian-lts-announce/2020/02/msg00004.html
• https://lists.debian.org/debian-lts-announce/2020/10/msg00000.html
• https://usn.ubuntu.com/4571-1/
• https://www.debian.org/security/2021/dsa-4918
• https://github.com/cyu/rack-cors/commit/e4d4fc362a4315808927011cbe5afcfe5486f17d
• https://github.com/cyu/rack-cors/compare/v1.0.3...v1.0.4
• https://lists.debian.org/debian-lts-announce/2020/02/msg00004.html
• https://lists.debian.org/debian-lts-announce/2020/10/msg00000.html
• https://usn.ubuntu.com/4571-1/
• https://www.debian.org/security/2021/dsa-4918

Get alerted when CVE-2019-18978 or the next vulnerability affects your stack