What’s Vulnerable › Vulnerabilities

CVE-2020-8161: Directory traversal in Rack::Directory app bundled with Rack

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-07-02 · updated 2026-06-17
• Weakness: CWE-548

Description

A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in information disclosure.

Affected products

• Canonical Ubuntu Linux: 18.04
• Debian Linux: 9.0, 10.0
• Rack Project Rack: before 2.2.0 — fixed in 2.2.0
• Rubygems Rack: before 2.1.3; 0.1.0, 0.2.0, 0.3.0, 0.4.0, 0.9.0, 0.9.1 (+82) — fixed in 2.1.3

How to fix

Upgrade to a fixed version: Rack Project Rack 2.2.0; Rubygems Rack 2.1.3. Check the vendor advisory for mitigations.

References

• https://groups.google.com/g/rubyonrails-security/c/IOO1vNZTzPA
• https://hackerone.com/reports/434404
• https://lists.debian.org/debian-lts-announce/2020/07/msg00006.html
• https://lists.debian.org/debian-lts-announce/2023/01/msg00038.html
• https://usn.ubuntu.com/4561-1/
• https://groups.google.com/g/rubyonrails-security/c/IOO1vNZTzPA
• https://hackerone.com/reports/434404
• https://lists.debian.org/debian-lts-announce/2020/07/msg00006.html
• https://lists.debian.org/debian-lts-announce/2023/01/msg00038.html
• https://usn.ubuntu.com/4561-1/

Get alerted when CVE-2020-8161 or the next vulnerability affects your stack