Incorrect Behavior Order: Validate Before Canonicalize in Rack - #VU159498
Published: November 5, 2026
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to receive a static file without the security headers configured for it through Rack's Rack::Static middleware. Missing headers such as Content-Disposition: attachment or a restrictive Content-Security-Policy can allow untrusted uploaded HTML to render inline. The file contents are served unchanged.
The vulnerability exists due to inconsistent request-path canonicalization between file selection and header_rules matching. Rack::Static#call selects the file using Utils.clean_path_info(Utils.unescape_path(path)), while Rack::Static#applicable_rules only URL-decodes the path before testing string and regular expression rules, leaving dot segments unnormalized. A remote attacker can request a known protected file using raw or percent-encoded dot segments to reach the normalized target while bypassing the header rules associated with its location.
For example, requests for /assets/../uploads/file.html or /assets/..%2fuploads/file.html serve uploads/file.html, but header matching uses /assets/../uploads/file.html, which does not match a directory rule scoped to uploads. The issue affects applications that use path-specific header_rules to attach security-relevant headers to particular paths or file types; applications without path-specific header_rules are not affected.