CVE-2026-85396

HIGH 7.5

rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../upload_backup/owned.sh to write files outside the intended extraction directory into sibling paths sharing the destination prefix.

CWE	CWE-22
Vendor	rubyzip
Product	rubyzip
Published	Sep 3, 2026
Last Updated	Sep 3, 2026

Stay Ahead of the Next One

Get instant alerts for rubyzip rubyzip

Be the first to know when new high vulnerabilities affecting rubyzip rubyzip are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

rubyzip / rubyzip

0 < 3.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/rubyzip/rubyzip/commit/17edfbf4423b83211b075acc23a7d8640da63449 github.com: https://github.com/rubyzip/rubyzip github.com: https://github.com/rubyzip/rubyzip/releases/tag/v3.4.0 github.com: https://github.com/rubyzip/rubyzip/blob/v3.3.1/lib/zip/entry.rb github.com: https://github.com/geo-chen/oss/blob/main/rubyzip.md vulncheck.com: https://www.vulncheck.com/advisories/rubyzip-before-3.4.0-path-traversal-in-zip-entry-extract-via-sibling-directory-prefix

Credits

George Chen