PT-2026-85229 · Rubygems · Rubyzip
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
rubyzip versions prior to 3.4.0
Description
An issue exists in the
Zip::Entry#extract function that allows for path traversal. The software fails to properly validate extraction paths when using prefix comparison without trailing separators. This allows an attacker to craft archive entries with names such as ../upload backup/owned.sh to write files outside the intended extraction directory into sibling paths that share the destination prefix.Recommendations
Update rubyzip to version 3.4.0 or later.
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Rubyzip