{"id":"CVE-2022-29970","published":"2022-05-02T00:00:00Z","modified":"2025-11-04T16:09:45Z","title":"Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files","vendor":null,"product":null,"tier":"tail","description":{"text":"Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02137,"percentile":0.81972,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/sinatra/sinatra/pull/1683/commits/462c3ca1db53ed3cfc394cf5948e9c948ad1c10e","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00034.html","tags":["mailing-list"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00020.html","tags":[]}],"priority":{"score":16.4,"factors":[{"name":"EPSS percentile","points":16.39}]},"affected":[{"ecosystem":"RubyGems","package":"sinatra","vulnerableRanges":["<2.2.0"],"patched":["2.2.0"],"from":["GHSA-qp49-3pvw-x4m5"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5007","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-sinatra-cve-2018-11627","parents":[{"from":"CVE-2018-11627","to":"CVE-2022-29970","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/sinatra/base.rb"],"commits":["https://github.com/sinatra/sinatra/commit/12786867d6faaceaec62c7c2cb5b0e2dc074d71a","https://github.com/sinatra/sinatra/commit/462c3ca1db53ed3cfc394cf5948e9c948ad1c10e"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2022-29970","to":"CVE-2022-45442","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:sinatra","fromFixed":"2.2.0","toFixed":"2.2.3","daysApart":210},{"kind":"same-code","provenance":"machine","files":["lib/sinatra/base.rb"],"commits":["https://github.com/sinatra/sinatra/commit/462c3ca1db53ed3cfc394cf5948e9c948ad1c10e","https://github.com/sinatra/sinatra/commit/ea8fc9495a350f7551b39e3025bfcd06f49f363b"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2018-7212","published":"2018-02-18","fixed":"2.0.1","kev":false},{"cve":"CVE-2018-11627","published":"2018-05-31","fixed":"2.0.2","kev":false},{"cve":"CVE-2022-29970","published":"2022-05-02","fixed":"2.2.0","kev":false},{"cve":"CVE-2022-45442","published":"2022-11-28","fixed":"3.0.4","kev":false},{"cve":"CVE-2024-21510","published":"2024-11-01","fixed":"4.1.0","kev":false},{"cve":"CVE-2025-61921","published":"2025-10-10","fixed":"4.2.0","kev":false}],"package":"RubyGems:sinatra"}}