Cybersecurity researchers have identified three significant vulnerabilities in the Rack Ruby web server interface that pose serious security risks. These flaws, discovered by OPSWAT, could allow attackers to access unauthorized files, inject malicious data, and manipulate logs under specific conditions.
## The Vulnerabilities
1. **CVE-2025-27610 (CVSS: 7.5)** – A path traversal vulnerability enabling access to all files under the specified root directory, provided attackers can determine file paths.
2. **CVE-2025-27111 (CVSS: 6.9)** – Improper neutralization of CRLF sequences that could be exploited to manipulate log entries and distort log files.
3. **CVE-2025-25184 (CVSS: 5.7)** – Similar CRLF neutralization issue allowing log manipulation and malicious data injection.
If exploited, these vulnerabilities could enable attackers to hide their tracks, access sensitive files, and inject malicious code. CVE-2025-27610 is particularly concerning as it allows unauthenticated attackers to potentially access configuration files, credentials, and confidential data.
## Technical Details
The primary issue stems from Rack::Static middleware, which serves static content like JavaScript and stylesheets but fails to properly sanitize user-supplied paths. When the `:root` parameter isn’t explicitly defined, Rack defaults to the current working directory, creating a security gap.
Organizations are advised to update to the latest version immediately. If patching isn’t possible, they should either remove Rack::Static usage or ensure the root parameter only points to directories containing publicly accessible files.
## Additional Critical Flaw in Infodraw Media Relay Service
Researchers have also discovered a critical vulnerability (CVE-2025-43928, CVSS: 9.8) in Infodraw Media Relay Service, which allows unauthorized file reading or deletion through path traversal in the login page. This affects systems used by law enforcement, private investigators, and public transport across multiple countries.
The vulnerability, which remains unpatched, allows login with usernames like “../../../../” on both Windows and Linux versions. Affected systems in Belgium and Luxembourg have been taken offline following disclosure.
Organizations using this service are advised to take applications offline immediately or implement additional protective measures such as VPN or IP restrictions.