Path Traversal Vulnerability in rubyzip by Ruby-zip
CVE-2026-85396

8.7HIGH

Key Information:

Vendor

Rubyzip

Status
Rubyzip
Vendor
CVE Published:
3 September 2026

What is CVE-2026-85396?

The rubyzip library versions prior to 3.4.0 are susceptible to a path traversal vulnerability in the Zip::Entry#extract function. This flaw occurs due to insufficient validation of paths during the extraction process. Malicious actors can exploit this by crafting ZIP archive entries with names designed to traverse directories, such as '../upload_backup/owned.sh', allowing them to write files to unintended locations outside the specified extraction directory. This poses a significant risk, as it can lead to unauthorized access and manipulation of sensitive files.

Affected Version(s)

rubyzip 0 < 3.4.0

rubyzip 3.4.0

References

https://github.com/rubyzip/rubyzip/commit/17edfbf4423b832...
patch
https://github.com/rubyzip/rubyzip
product
https://github.com/rubyzip/rubyzip/releases/tag/v3.4.0
release-notes

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.