Threats tagged 'ghsa-7wqh-767x-r66v'

CVE-2025-27610 is a Local File Inclusion vulnerability in Rack::Static that allows attackers to access files under the specified root directory by exploiting improper sanitization of user-supplied paths. Encoded path traversal sequences are not correctly validated, enabling unauthorized file access. This affects multiple Rack versions prior to 2.2.13, 3.0.14, and 3.1.12. The vulnerability has a high severity with a CVSS score of 7.5. Remediation is available via updates to fixed versions or by restricting the root directory contents.