CVE-2018-1000079: Path Traversal
Last updated 18 August 2025
Other sources
Path traversal issue during gem installation allows to write to arbitrary filesystem locations.
Upstream fixes:
https://github.com/rubygems/rubygems/commit/f83f911e19e27cbac1ccce7471d96642241dd759 https://github.com/rubygems/rubygems/commit/666ef793cad42eed96f7aee1cdf77865db921099
External References:
https://www.ruby-lang.org/en/news/2018/02/17/multiple-vulnerabilities-in-rubygems/
— Red Hat
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is vulnerability CVE-2018-1000079?
CVE-2018-1000079 is a vulnerability in RubyGems that allows for directory traversal during gem installation.
What is the severity of CVE-2018-1000079?
The severity of CVE-2018-1000079 is medium with a CVSS score of 5.5.
Which versions of RubyGems are affected by CVE-2018-1000079?
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 are affected by CVE-2018-1000079.
How can I fix CVE-2018-1000079?
To fix CVE-2018-1000079, update to RubyGems version 2.7.6 or later.
Where can I find more information about CVE-2018-1000079?
You can find more information about CVE-2018-1000079 on the RubyGems blog and the GitHub commits mentioned in the references.