CVE-2022-29970

Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files

published May 2, 2022

CVSS
—
EPSS
2%
Percentile
81.9
In the wild
Unconfirmed
What it is

Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02137 · 81.9th percentile
Published
2022-05-02T00:00Z
EPSS history
Timeline
  • 02 MAY 00:00Z
    Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files
    cvelistv5