CVE-2026-85396
Received Received - Intake

Path Traversal in RubyZip Archive Extraction

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description
rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../upload_backup/owned.sh to write files outside the intended extraction directory into sibling paths sharing the destination prefix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-04
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85396
EUVD
EUVD-2026-70673

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rubyzip rubyzip to 3.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in rubyzip versions before 3.4.0. It occurs in the Zip::Entry#extract method where extraction paths are not properly validated. Attackers can exploit this by creating archive entries with names like ../upload_backup/owned.sh to write files outside the intended directory into sibling paths that share the destination prefix.

Detection Guidance

Check for rubyzip versions before 3.4.0 using commands like 'gem list rubyzip' or 'bundle list | grep rubyzip'. Inspect archives for entries with paths containing '../' or similar traversal patterns before extraction.

Impact Analysis

This vulnerability allows attackers to write arbitrary files to locations outside the intended extraction directory. This could lead to remote code execution, overwriting critical system files, or installing malicious scripts on the server. It poses a significant risk to data integrity and system security.

Compliance Impact

This vulnerability could lead to unauthorized file access or modification, violating data integrity and confidentiality requirements under GDPR and HIPAA. It may result in non-compliance due to potential data breaches or unauthorized system access, leading to legal and financial penalties.

Mitigation Strategies

Upgrade rubyzip to version 3.4.0 or later immediately. Avoid extracting untrusted archives or validate paths strictly during extraction to prevent path traversal.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85396. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart