Path Traversal Vulnerability in RubyGems Affected by Symlink Resolution

CVE-2026-82455

What is CVE-2026-82455?

A serious vulnerability has been identified in RubyGems where improper handling of filesystem symlinks during gem extraction allows files to be extracted outside the designated directory. This flaw occurs when a symlink within the destination directory points to a location outside of it, potentially compromising the safety of the extraction process. The issue arises from RubyGems failing to re-validate path containment after resolving the symlink. To address this, the fix implemented ensures that the real path of the parent directory is verified before writing files, thus raising an error if the extraction attempts to escape the intended directory boundaries.

References