Rack::Static determines whether a URL should be served by checking only the string prefix of the request path against a configured prefix. Because it does not confirm that the matched path refers to an existing file, requests such as "/css-config.env" or "/css-backup.sql" can cause Rack to expose any file whose name starts with the prefix, allowing an attacker to read sensitive data or configuration files.

The vulnerability affects the Rack framework, specifically the rack:rack library. Versions prior to 2.2.23, 3.1.21, and 3.2.6 are impacted; updating to these patched releases removes the insecure prefix matching behavior.

The CVSS score of 7.5 signals a high severity, yet the EPSS score below 1% indicates that exploitation is unlikely at present, and this vulnerability is not listed in CISA's KEV catalog. The likely attack vector is a crafted HTTP GET request that uses a known static prefix but points to a sensitive file; based on the description, it is inferred that such a request would cause Rack to serve the file and disclose its contents. No special privileges are required for the attacker to perform this action.