CVE-2026-82455
RubyGems before 4.0.13 Path Traversal via Symlink Resolution
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be written outside of it, breaking the extraction safety boundary. The fix resolves the real path of the parent directory before writing and raises Gem::Package::PathError if it escapes the destination directory.
| CWE | CWE-59 |
| Vendor | ruby |
| Product | rubygems |
| Ecosystems | |
| Industries | Technology |
| Published | Aug 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for ruby rubygems
Be the first to know when new high vulnerabilities affecting ruby rubygems are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High
Affected Versions
ruby / rubygems
3.2.30 < 4.0.13
References
github.com: https://github.com/ruby/rubygems/pull/9493 github.com: https://github.com/ruby/rubygems/commit/103ca4230deacb31b9fcd813de109e83b5fc71ac github.com: https://github.com/ruby/rubygems vulncheck.com: https://www.vulncheck.com/advisories/rubygems-before-4.0.13-path-traversal-via-symlink-resolution
Credits
🔍 Ali Firas