The vulnerability in Ruby Sinatra prior to version 2.2.0 involves insufficient validation of the expanded path against the public_dir when serving static files. This flaw can lead to directory traversal or unauthorized file access by allowing requests to access files outside the designated public directory. The affected versions include specific releases such as 1.4.6-2, 1.4.7-3, 1.4.7-5, 1.4.8-1, and 2.0.8.1-2. There is no indication of known exploits in the wild. No official patch or remediation details are provided in the input data.

An attacker could exploit this vulnerability to read sensitive files outside the intended public directory, potentially exposing confidential information. The CVSS vector indicates high confidentiality impact with no impact on integrity or availability. This could lead to information disclosure without requiring privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to sensitive files via other means and avoid exposing Sinatra applications with affected versions to untrusted networks.