Directory Traversal Vulnerability in Rubyzip by Ruby

CVE-2018-1000544

What is CVE-2018-1000544?

The rubyzip library version 1.2.1 and earlier is susceptible to a directory traversal vulnerability in its Zip::File component. This flaw allows attackers to exploit web applications that permit uploading of .zip files. By crafting a malicious .zip file containing symlinks or files with absolute pathnames (e.g., '../'), an attacker can potentially write arbitrary files to the filesystem, leading to unauthorized access or manipulation of sensitive data. This vulnerability underscores the importance of proper validation and sanitation of uploaded files in web applications.

References