5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34830

CVE-2026-34830: Rack: Rack::Sendfile regex injection via HTTP_X_ACCEL_MAPPING header allows arbitrary file reads through nginx

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Sendfile#map_accel_path interpolates the value of the X-Accel-Mapping request header directly into a regular expression when rewriting file paths for X-Accel-Redirect. Because the header value is not escaped, an attacker who can supply X-Accel-Mapping to the backend can inject regex metacharacters and control the generated X-Accel-Redirect response header. In deployments using Rack::Sendfile with x-accel-redirect, this can allow an attacker to cause nginx to serve unintended files from configured internal locations. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34830

CVE-2026-34830:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
rack	rubygems	< 2.2.23	2.2.23
rack	rubygems	>= 3.0.0.beta1, < 3.1.21	3.1.21
rack	rubygems	>= 3.2.0, < 3.2.6	3.2.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the Rack::Sendfile.map_accel_path function, which handles path rewriting for Nginx's X-Accel-Redirect feature. The function reads path mappings from the X-Accel-Mapping HTTP request header. The root cause of the vulnerability is the failure to sanitize the value read from this header before using it in a regular expression. Specifically, the internal part of the mapping is used directly in path.sub(/\A#{internal}/i, external). An attacker can supply regex metacharacters (e.g., .*) in the X-Accel-Mapping header, which are then interpreted by the Ruby regex engine. This allows them to control the generated X-Accel-Redirect path and access files that are not meant to be public. The patch, identified in commit 7f288de93768b5cc44a5f4ed1ac02470d8fe52f4, resolves this by escaping the internal variable using Regexp.escape, ensuring it is treated as a literal string rather than a pattern.

Vulnerable functions

Rack::Sendfile.map_accel_path

lib/rack/sendfile.rb

The `map_accel_path` function in `Rack::Sendfile` processes the `X-Accel-Mapping` request header. The `internal` variable, derived from this header, is directly interpolated into a regular expression without escaping. This allows an attacker to inject regex metacharacters, manipulate the path substitution, and cause the `X-Accel-Redirect` header to point to an unauthorized file, leading to arbitrary file disclosure.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.