{"id":"CVE-2026-34830","aliases":["GHSA-qv7j-4883-hwh7"],"url":"https://o3.security/vulnerability/CVE-2026-34830","summary":"Rack: Rack::Sendfile regex injection via HTTP_X_ACCEL_MAPPING header allows arbitrary file reads through nginx","details":"Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Sendfile#map_accel_path interpolates the value of the X-Accel-Mapping request header directly into a regular expression when rewriting file paths for X-Accel-Redirect. Because the header value is not escaped, an attacker who can supply X-Accel-Mapping to the backend can inject regex metacharacters and control the generated X-Accel-Redirect response header. In deployments using Rack::Sendfile with x-accel-redirect, this can allow an attacker to cause nginx to serve unintended files from configured internal locations. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.","published":"2026-04-02T16:47:40.490Z","modified":"2026-07-27T03:56:23.229502155Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"RubyGems","name":"rack","fixedVersion":"2.2.23"},{"ecosystem":"RubyGems","name":"rack","fixedVersion":"3.1.21"},{"ecosystem":"RubyGems","name":"rack","fixedVersion":"3.2.6"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34830.json"},{"type":"ADVISORY","url":"https://github.com/rack/rack/security/advisories/GHSA-qv7j-4883-hwh7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34830"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-27T03:56:23.229502155Z"}}