GHSA-7mqq-6cf9-v2qp Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory

• RubyGems rack: < 2.2.23 → fixed in 2.2.23 • RubyGems rack: >= 3.0.0.beta1, < 3.1.21 → fixed in 3.1.21 • RubyGems rack: >= 3.2.0, < 3.2.6 → fixed in 3.2.6

Summary `Rack::Directory` interpolates the configured `root` path directly into a regular expression when deriving the displayed directory path. If `root` contains regex metacharacters such as `+`, `*`, or `.`, the prefix stripping can fail and the generated directory listing may expose the full filesystem path in the HTML output. Details `Rack::Directory::DirectoryBody#each` computes the visible path using code equivalent to: ```ruby show_path = Utils.escape_html(path.sub(/\A#{root}/, '')) ``` Here, `root` is a developer-configured filesystem path. It is normalized earlier with `File.expand_path(root)` and then inserted directly into a regular expression without escaping. Because the value is treated as regex syntax rather than as a literal string, metacharacters in the configured path can change how the prefix match behaves. When that happens, the expected root prefix is not removed from `path`, and the absolute filesystem path is rendered into the HTML directory listing. Impact If `Rack::Directory` is configured to serve a directory whose absolute path contains regex metacharacters, the generated directory listing may disclose the full server filesystem path instead of only the request-relative path. This can expose internal deployment details such as directory layout, usernames, mount points, or naming conventions that would otherwise not be visible to clients. Mitigation • Update to a patched version of Rack in which the root prefix is removed using an escaped regular expression. • Avoid using `Rack::Directory` with a root path that contains regular expression metacharacters.