CVE-2020-8161

A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in information disclosure.

• CWE-548
• CWE-22

• https://groups.google.com/g/rubyonrails-security/c/IOO1vNZTzPAMailing List, Patch, Third Party Advisory
• https://hackerone.com/reports/434404Permissions Required, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/07/msg00006.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/01/msg00038.htmlMailing List, Third Party Advisory
• https://usn.ubuntu.com/4561-1/Third Party Advisory
• https://groups.google.com/g/rubyonrails-security/c/IOO1vNZTzPAMailing List, Patch, Third Party Advisory
• https://hackerone.com/reports/434404Permissions Required, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/07/msg00006.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/01/msg00038.htmlMailing List, Third Party Advisory
• https://usn.ubuntu.com/4561-1/Third Party Advisory

Published

Jul 2, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8155An outdated 3rd party library in the Files PDF viewer for Ne…5.4
• CVE-2020-8156A missing verification of the TLS host in Nextcloud Mail 1.1…7
• CVE-2020-8157UniFi Cloud Key firmware <= v1.1.10 for Cloud Key gen2 and C…6.8
• CVE-2020-8158Prototype pollution vulnerability in the TypeORM package < 0…9.8
• CVE-2020-8159There is a vulnerability in actionpack_page-caching gem < v1…9.8
• CVE-2020-8160MendixSSO <= 2.1.1 contains endpoints that make use of the o…6.1
• CVE-2020-8162A client side enforcement of server side security vulnerabil…7.5
• CVE-2020-8163The is a code injection vulnerability in versions of Rails p…8.8
• CVE-2020-8164A deserialization of untrusted data vulnerability exists in …7.5
• CVE-2020-8165A deserialization of untrusted data vulnernerability exists …9.8
• CVE-2020-8166A CSRF forgery vulnerability exists in rails < 5.2.5, rails …4.3
• CVE-2020-8167A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs modu…6.5