Rack, a modular Ruby web server interface, implements directory listing through the Rack::Directory middleware. Prior to specified releases, the middleware performed a path check by matching the expanded path against the configured root using a simple string prefix comparison. This logic flaw lets an attacker craft a request such as '/../root_example/' that bypasses the root restriction, resulting in directory listings outside the intended root. The exposed data can include configuration files, source code, or other sensitive files located above the documented root, thereby compromising confidentiality.

The vulnerability affects all Rack installations running versions earlier than 2.2.22, 3.1.20, or 3.2.5. These releases are distributed by the Rack project and used by Ruby web applications that rely on the Rack::Directory middleware for static file serving.

The CVSS score of 7.5 indicates high severity. The EPSS score is less than 1%, suggesting low current exploitation probability, though planning or targeted attacks remain feasible. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it remotely by sending HTTP requests to an application that employs Rack::Directory. Successful exploitation permits listing of directories outside the configured root, potentially exposing sensitive information without requiring authentication.