Data breachcritical
Researchers Identify Rack::Static Vulnerability Enabling Data Breaches in Ruby Servers
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-25184 | Rack provides an interface for developing web applications in Ruby | 5.7 | 1% | PoC | |
| CVE-2025-27111 | Rack: The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type header. An attacker can exploit this by… | 6.9 | <1% | ||
| CVE-2025-27610 | Rack provides an interface for developing web applications in Ruby | 7.5 | 1% | ||
| CVE-2025-43928 | In Infodraw Media Relay Service (MRS) 7.1.0.0, the MRS web server (on port 12654) allows reading arbitrary files via ../ directory traversal in the username… | 9.8 | <1% | PoC |
From the original article
3 min read at thehackernews.com
Ravie Lakshmanan Apr 25, 2025 Vulnerability / Data Breach Cybersecurity researchers have disclosed three security flaws in the Rack Ruby web server interface that, if successfully exploited, could enable attackers to gain unauthorized access to files, inject malicious data, and tamper with logs under certain conditions. The vulnerabilities, flagged by cybersecurity vendor OPSWAT, are listed below -
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.