← Vulnerability feed

Vulnerability record · CVE-2013-0262 · published 8 February 2013

CVE-2013-0262: Rack project rack path traversal vulnerability

Rack Project · Rack

rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."

4.3 CVSS 2.0 Medium EPSS 2.9% · top 13.3% CWE-22 · Path traversal
4.3CVSS 2.0 base score
2.9%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
20References
16 Jun 2026Last modified by NVD

Description

rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."

AV:N/AC:M/Au:N/C:P/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html
http://rack.github.com/
http://secunia.com/advisories/52033 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=909071
https://bugzilla.redhat.com/show_bug.cgi?id=909072
https://gist.github.com/rentzsch/4736940
https://github.com/rack/rack/blob/master/lib/rack/file.rb#L56
https://github.com/rack/rack/commit/6f237e4c9fab649d3750482514f0fde76c56ab30
https://groups.google.com/forum/#%21msg/rack-devel/bf937jPZxJM/1s6x95vIhmAJ
https://groups.google.com/forum/#%21msg/rack-devel/mZsuRonD7G8/DpZIOmMLbOgJ
http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html
http://rack.github.com/
http://secunia.com/advisories/52033 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=909071
https://bugzilla.redhat.com/show_bug.cgi?id=909072
https://gist.github.com/rentzsch/4736940
https://github.com/rack/rack/blob/master/lib/rack/file.rb#L56
https://github.com/rack/rack/commit/6f237e4c9fab649d3750482514f0fde76c56ab30
https://groups.google.com/forum/#%21msg/rack-devel/bf937jPZxJM/1s6x95vIhmAJ
https://groups.google.com/forum/#%21msg/rack-devel/mZsuRonD7G8/DpZIOmMLbOgJ

Track CVE-2013-0262 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2022-30123Rack project rack vulnerabilityA sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and Common…EPSS 1.9%8.6CVE-2020-8161Rack project rack path traversal vulnerabilityA directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory a…EPSS 3.4%7.5CVE-2022-30122Rack project rack uncontrolled resource consumption vulnerabilityA possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.EPSS 2.2%7.5CVE-2020-8184Rack project rack improper input validation vulnerabilityA reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an…EPSS 2.9%7.5CVE-2018-16470Rack project rack uncontrolled resource consumption vulnerabilityThere is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause the multipart parser to ente…EPSS 2.0%6.1CVE-2018-16471Rack project rack cross-site scripting vulnerabilityThere is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method…EPSS 1.9%5.1CVE-2013-0263Rack project rack vulnerabilityRack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote a…EPSS 5.4%5.0CVE-2015-3225Rack project rack vulnerabilitylib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to …EPSS 8.0%

Source: NIST National Vulnerability Database (record CVE-2013-0262), CISA KEV, FIRST EPSS (scores of 2026-10-02). This page is refreshed as NVD updates the record.