Updated advisory posts against rubysec/ruby-advisory-db@23d78a1

Author: jamgregory

advisories/_posts/2026-02-17-CVE-2026-22860.md

@@ -0,0 +1,50 @@
+---
+layout: advisory
+title: 'CVE-2026-22860 (rack): Rack has a Directory Traversal via Rack:Directory'
+comments: false
+categories:
+- rack
+advisory:
+  gem: rack
+  cve: 2026-22860
+  ghsa: mxw3-3hh2-x2mh
+  url: https://github.com/rack/rack/security/advisories/GHSA-mxw3-3hh2-x2mh
+  title: Rack has a Directory Traversal via Rack:Directory
+  date: 2026-02-17
+  description: |-
+    ## Summary
+
+    `Rack::Directory`’s path check used a string prefix match
+    on the expanded path. A request like `/../root_example/` can escape the configured
+    root if the target path starts with the root string, allowing directory listing
+    outside the intended root.
+
+    ## Details
+
+    In `directory.rb`, `File.expand_path(File.join(root,
+    path_info)).start_with?(root)` does not enforce a path boundary. If the server root
+    is `/var/www/root`, a path like `/var/www/root_backup` passes the check because
+    it shares the same prefix, so `Rack::Directory` will list that directory also.
+
+    ## Impact
+
+    Information disclosure via directory listing outside the configured root
+    when `Rack::Directory` is exposed to untrusted clients and a directory shares the
+    root prefix (e.g., `public2`, `www_backup`).
+
+    ## Mitigation
+
+    * Update to a patched
+    version of Rack that correctly checks the root prefix.\n* Don't name directories
+    with the same prefix as one which is exposed via `Rack::Directory`."
+  cvss_v3: 7.5
+  patched_versions:
+  - "~> 2.2.22"
+  - "~> 3.1.20"
+  - ">= 3.2.5"
+  related:
+    url:
+    - https://github.com/rack/rack/security/advisories/GHSA-mxw3-3hh2-x2mh
+    - https://github.com/rack/rack/commit/75c5745c286637a8f049a33790c71237762069e7
+    - https://github.com/advisories/GHSA-mxw3-3hh2-x2mh
+---

advisories/_posts/2026-02-17-CVE-2026-25500.md

@@ -0,0 +1,61 @@
+---
+layout: advisory
+title: 'CVE-2026-25500 (rack): Stored XSS in Rack::Directory via javascript: filenames
+  rendered into anchor href'
+comments: false
+categories:
+- rack
+advisory:
+  gem: rack
+  cve: 2026-25500
+  ghsa: whrj-4476-wvmp
+  url: https://github.com/rack/rack/security/advisories/GHSA-whrj-4476-wvmp
+  title: 'Stored XSS in Rack::Directory via javascript: filenames rendered into anchor
+    href'
+  date: 2026-02-17
+  description: |-
+    ## Summary
+
+    `Rack::Directory` generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename begins with the `javascript:` scheme (e.g. `javascript:alert(1)`), the generated index includes an anchor whose `href` attribute is exactly `javascript:alert(1)`. Clicking this entry executes arbitrary JavaScript in the context of the hosting application.
+
+    This results in a client-side XSS condition in directory listings generated by `Rack::Directory`.
+
+    ## Details
+
+    `Rack::Directory` renders directory entries using an HTML row template similar to:
+
+    ```html
+    <a href='%s'>%s</a>
+    ```
+
+    The `%s` placeholder is populated directly with the file’s basename. If the basename begins with `javascript:`, the resulting HTML contains an executable JavaScript URL:
+
+    ```html
+    <a href='javascript:alert(1)'>javascript:alert(1)</a>
+    ```
+
+    Because the value is inserted directly into the `href` attribute without scheme validation or normalization, browsers interpret it as a JavaScript URI. When a user clicks the link, the JavaScript executes in the origin of the Rack application.
+
+    ## Impact
+
+    If `Rack::Directory` is used to expose filesystem contents over HTTP, an attacker who can create or upload files within that directory may introduce a malicious filename beginning with `javascript:`.
+
+    When a user visits the directory listing and clicks the entry, arbitrary JavaScript executes in the application's origin. Exploitation requires user interaction (clicking the malicious entry).
+
+    ## Mitigation
+
+    * Update to a patched version of Rack in which `Rack::Directory` prefixes generated anchors with a relative path indicator (e.g. `./filename`).
+    * Avoid exposing user-controlled directories via `Rack::Directory`.
+    * Apply a strict Content Security Policy (CSP) to reduce impact of potential client-side execution issues.
+    * Where feasible, restrict or sanitize uploaded filenames to disallow dangerous URI scheme prefixes.
+  cvss_v3: 5.4
+  patched_versions:
+  - "~> 2.2.22"
+  - "~> 3.1.20"
+  - ">= 3.2.5"
+  related:
+    url:
+    - https://github.com/rack/rack/security/advisories/GHSA-whrj-4476-wvmp
+    - https://github.com/rack/rack/commit/f2f225f297b99fbee3d9f51255d41f601fc40aff
+    - https://github.com/advisories/GHSA-whrj-4476-wvmp
+---