Rack is a modular Ruby web server interface. In versions prior to 2.2.23, 3.1.21, and 3.2.6, the Rack::Sendfile#map_accel_path method interpolates the value of the X-Accel-Mapping request header directly into a regular expression used for rewriting file paths for X-Accel-Redirect. Because this header value is not escaped, an attacker who can supply X-Accel-Mapping to the backend can inject regex metacharacters and control the generated X-Accel-Redirect response header, leading to arbitrary file reads from internal locations, a pattern consistent with CWE-625.

The affected component is Rack, the Ruby web server interface library. The vulnerability affects all releases of Rack older than 2.2.23, 3.1.21, and 3.2.6. These versions are widely used in Ruby applications that rely on Rack::Sendfile with nginx's X-Accel-Redirect feature.

The CVSS score for this issue is 5.9, indicating moderate severity. EPSS data is not provided, and the vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector is a crafted HTTP request containing a malicious X-Accel-Mapping header sent to a Rack application sitting behind nginx configured for X-Accel-Redirect. If exploited, the attacker could cause nginx to serve unintended files from configured internal locations, potentially exposing sensitive data. Because the attack requires only the ability to supply request headers, it can be performed over the public network, but it is mitigated by the patch.