PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›CVE-2022-29970

CVE-2022-29970

sinatra: path traversal possible outside of public_dir when serving static files

Loading…

Severity

Important

Red Hat Product Security

7.5

CVSS 3.1

Review impact separately from score.

Published · May 2, 2022

Updated · November 2, 2026

Description

A flaw was found in Sinatra when serving static files from the public directory. The requested path is not validated if it is in the public directory, allowing files outside of the public directory to be served.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

Disable the static option which will disable the public_dir option. With this configuration, Sinatra will not serve files from the public directory and therefore files outside of it.

CVSS / CWE

CVSS 3.1 · 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-22 · Improper Limitation of a Pathname to a Restricted Directory