{"action":"Upgrade rack to 2.2.13 or later.","affected":[{"fixed":"2.2.13","introduced":"0"},{"fixed":"3.0.14","introduced":"3.0"},{"fixed":"3.1.12","introduced":"3.1"}],"component":"rack","cve_ids":["CVE-2025-27610"],"ecosystem":"RubyGems","epss":0.01173,"exploited":false,"fixed_versions":["2.2.13","3.0.14","3.1.12"],"ghsa_id":"GHSA-7wqh-767x-r66v","id":"tcs_01M5KEHV17Z7P5DFFFR7WVZX7A","modified_at":"2026-09-10T03:49:48.459827132Z","published_at":"2025-03-10T22:19:30Z","references":["https://osv.dev/vulnerability/GHSA-7wqh-767x-r66v","https://github.com/rack/rack/security/advisories/GHSA-7wqh-767x-r66v","https://nvd.nist.gov/vuln/detail/CVE-2025-27610","https://github.com/rack/rack/commit/50caab74fa01ee8f5dbdee7bb2782126d20c6583","https://github.com/rack/rack","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2025-27610.yml","https://lists.debian.org/debian-lts-announce/2025/03/msg00016.html"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-7wqh-767x-r66v","url":"https://osv.dev/vulnerability/GHSA-7wqh-767x-r66v"}],"summary":"Local File Inclusion in Rack::Static"}