Debian DLA-4505-1 ruby-rack Critical Directory Listing XSS

CVE-2026-22860

Rack::Directory's path check used a string prefix match on the
expanded path. A request like /../root_example/ could escape the
configured root if the target path started with the root string,
allowing directory listing outside the intended root.

CVE-2026-25500

Rack::Directory generated an HTML directory index where each file
entry was rendered as a clickable link. If a file existed on disk
whose basename started with the javascript: scheme, the generated
index contained an anchor whose href executed JavaScript in the
browser, resulting in a stored XSS vulnerability.

For Debian 11 bullseye, these problems have been fixed in version
2.1.4-3+deb11u5.

We recommend that you upgrade your ruby-rack packages.

For the detailed security status of ruby-rack please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/ruby-rack

Further information about Debian LTS security advisories, how to apply