CVE-2026-82455

Name of the Vulnerable Software and Affected Versions RubyGems versions prior to 4.0.13

Description RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. If a pre-existing symlink within the destination directory points outside the extraction root, files can be written outside the intended destination directory, bypassing the extraction safety boundary. This occurs because the system does not properly verify the real path of the parent directory before writing, which can be mitigated by raising a Gem::Package::PathError when the path escapes the destination directory.

Recommendations Update RubyGems to version 4.0.13 or later.