All vulnerabilities
CVE-2026-85396GHSA-47m2-wp7j-p9vc

rubyzip path traversal vulnerability

rubyzip rubyziprubygemsLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.56%Chance of exploitation activity in the next 30 days, higher than 46% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.4.0Fixed versionGitHub
Published3 Sep 2026Updated 25 Sep 2026CVE List

What fixes it

  • 3.4.0rubyzip, rubygemsGitHub
  • 3.4.0rubyzipCVE List
  • 3.4.0rubyzip, RubyGemsOSVbundle update rubyzip --conservative # needs 3.4.0 or later

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../upload_backup/owned.sh to write files outside the intended extraction directory into sibling paths sharing the destination prefix.

Text from CVE List

Affected versions 53

  • rubyzip, rubygems< 3.4.0GitHub
  • rubyzipaffected: all versions before 3.4.0CVE List
  • rubyzipunaffected: 3.4.0CVE List
  • rubyzip, RubyGemsfrom first release, fixed in 3.4.0OSV
  • rubyzip, RubyGems0.5.11OSV
  • rubyzip, RubyGems0.5.12OSV
  • rubyzip, RubyGems0.5.7OSV
  • rubyzip, RubyGems0.5.8OSV
  • rubyzip, RubyGems0.5.9OSV
  • rubyzip, RubyGems0.9.1OSV
  • rubyzip, RubyGems0.9.4OSV
  • rubyzip, RubyGems0.9.5OSV
  • rubyzip, RubyGems0.9.6.1OSV
  • rubyzip, RubyGems0.9.7OSV
  • rubyzip, RubyGems0.9.8OSV
  • rubyzip, RubyGems0.9.9OSV
  • rubyzip, RubyGems1.0.0OSV
  • rubyzip, RubyGems1.0.0.beta1OSV
  • rubyzip, RubyGems1.1.0OSV
  • rubyzip, RubyGems1.1.1OSV
  • rubyzip, RubyGems1.1.2OSV
  • rubyzip, RubyGems1.1.3OSV
  • rubyzip, RubyGems1.1.4OSV
  • rubyzip, RubyGems1.1.5OSV
  • rubyzip, RubyGems1.1.6OSV
  • rubyzip, RubyGems1.1.7OSV
  • rubyzip, RubyGems1.2.0OSV
  • rubyzip, RubyGems1.2.1OSV
  • rubyzip, RubyGems1.2.2OSV
  • rubyzip, RubyGems1.2.3OSV
  • rubyzip, RubyGems1.2.4OSV
  • rubyzip, RubyGems1.3.0OSV
  • rubyzip, RubyGems2.0.0OSV
  • rubyzip, RubyGems2.1.0OSV
  • rubyzip, RubyGems2.2.0OSV
  • rubyzip, RubyGems2.3.0OSV
  • rubyzip, RubyGems2.3.1OSV
  • rubyzip, RubyGems2.3.2OSV
  • rubyzip, RubyGems2.4.1OSV
  • rubyzip, RubyGems2.4.rc1OSV
  • rubyzip, RubyGems3.0.0OSV
  • rubyzip, RubyGems3.0.0.alphaOSV
  • rubyzip, RubyGems3.0.0.rc1OSV
  • rubyzip, RubyGems3.0.0.rc2OSV
  • rubyzip, RubyGems3.0.1OSV
  • rubyzip, RubyGems3.0.2OSV
  • rubyzip, RubyGems3.1.0OSV
  • rubyzip, RubyGems3.1.1OSV
  • rubyzip, RubyGems3.2.0OSV
  • rubyzip, RubyGems3.2.1OSV
  • rubyzip, RubyGems3.2.2OSV
  • rubyzip, RubyGems3.3.0OSV
  • rubyzip, RubyGems3.3.1OSV

References 9