Rack has a Directory Traversal via Rack:Directory

Rack::Directory allows attackers to list files and directories outside the intended root folder by crafting special URLs with path traversal sequences. This happens because the security check only compares text strings instead of properly validating the actual file path.

Rack::Directory uses a string prefix match on expanded paths to validate directory access, which can be bypassed via path traversal sequences like `/../root_example/` when the target path starts with the configured root string. An unauthenticated attacker can exploit this CWE-22 vulnerability to enumerate directories outside the intended root, leading to information disclosure (CWE-548). The issue is fixed in versions 2.2.22, 3.1.20, and 3.2.5.