VYPR
← All advisories
High severityNVD Advisory· Published May 2, 2022· Updated Nov 4, 2025

CVE-2022-29970

CVE-2022-29970

Description

Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Sinatra before 2.2.0 fails to validate that the expanded static file path matches the intended public_dir, enabling directory traversal.

Vulnerability

Sinatra versions before 2.2.0 do not validate that the expanded path of a requested static file remains within the configured public_dir directory [1][2]. This lack of path equivalence checking allows a crafted URL to escape the intended public directory and serve arbitrary files from the server's filesystem if static file serving is enabled (default in classic style). The affected versions include all releases prior to 2.2.0 [3].

Exploitation

An attacker can send an HTTP request to the Sinatra application with a path containing ../ sequences (e.g., /../../etc/passwd) to traverse outside public_dir. The server's static file handler will resolve the path without verifying that the ultimate target lies within the allowed directory. No authentication is required, as the vulnerability is exercised during normal static file serving [2][3].

Impact

Successful exploitation allows an attacker to read arbitrary files from the server's filesystem that the application process has permission to access. This can lead to disclosure of sensitive information such as configuration files, source code, or credentials. The impact is limited to information disclosure; the vulnerability does not directly enable code execution or data modification [2][4].

Mitigation

The vulnerability is fixed in Sinatra version 2.2.0 [1][3]. Users should upgrade to at least 2.2.0 to ensure the expanded path is validated against the public_dir boundary. If immediate upgrade is not possible, disabling static file serving or using a reverse proxy to restrict URL path resolution can serve as temporary workarounds. No known exploitation in the wild has been reported as of the publication date, and the CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog [4].

References
  1. GitHub - sinatra/sinatra: Classy web-development dressed in a DSL (official / canonical repo)
  2. NVD - CVE-2022-29970
  3. Validate expanded path matches public_dir when serving static files by cji-stripe · Pull Request #1683 · sinatra/sinatra
  4. ruby-advisory-db/gems/sinatra/CVE-2022-29970.yml at master · rubysec/ruby-advisory-db

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
sinatraRubyGems
< 2.2.02.2.0

Affected products

50

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

8

News mentions

0

No linked articles in our index yet.