CVE-2026-25500
📋 TL;DR
This vulnerability allows cross-site scripting (XSS) attacks in Rack's directory listing feature. When Rack::Directory generates HTML directory indexes, it doesn't properly sanitize filenames starting with 'javascript:' schemes, allowing malicious JavaScript execution when users click on these file links. This affects Ruby web applications using vulnerable Rack versions with directory listings enabled.
💻 Affected Systems
- Rack (Ruby web server interface)
📦 What is this software?
Rack by Rack
Rack by Rack
Rack by Rack
⚠️ Risk & Real-World Impact
Worst Case
Attackers could execute arbitrary JavaScript in victims' browsers, potentially stealing session cookies, performing actions as the user, or redirecting to malicious sites.
Likely Case
Limited XSS attacks requiring user interaction (clicking on malicious file links) in directory listings, potentially leading to session hijacking or credential theft.
If Mitigated
No impact if directory listings are disabled or proper input sanitization is implemented.
🎯 Exploit Status
Exploitation requires attackers to upload or create files with 'javascript:' prefixed names in directories served by Rack::Directory, then trick users into clicking the generated links.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Rack 2.2.22, 3.1.20, or 3.2.5
Vendor Advisory: https://github.com/rack/rack/security/advisories/GHSA-whrj-4476-wvmp
Restart Required: Yes
Instructions:
1. Update Gemfile to specify rack version >=2.2.22, >=3.1.20, or >=3.2.5. 2. Run 'bundle update rack'. 3. Restart your Ruby application server.
🔧 Temporary Workarounds
Disable directory listings
allDisable Rack::Directory usage in your application configuration
# In config.ru or application config, remove or comment out use of Rack::Directory
Filename sanitization middleware
allAdd middleware to sanitize filenames before Rack::Directory processes them
# Implement custom middleware that filters or renames files starting with 'javascript:'
🧯 If You Can't Patch
- Disable directory listing functionality entirely in your application
- Implement web application firewall (WAF) rules to block requests containing 'javascript:' in directory paths
🔍 How to Verify
Check if Vulnerable:
Check if your application uses Rack::Directory and if Rack version is below 2.2.22, 3.1.20, or 3.2.5Check Version:
bundle show rack | grep rackVerify Fix Applied:
Verify Rack version is >=2.2.22, >=3.1.20, or >=3.2.5 and test directory listings with 'javascript:' prefixed filenames📡 Detection & Monitoring
Log Indicators:
- Requests to directory listings with 'javascript:' in filenames
- Unusual file uploads with 'javascript:' prefixes
Network Indicators:
- HTTP requests containing 'javascript:' in URL paths to directory endpoints
SIEM Query:
source="web_logs" AND (url="*javascript:*" OR filename="*javascript:*") AND path="*/directory/*"