CVE-2026-85396: rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix
rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../uploadbackup/owned.sh to write files outside the intended extraction directory into sibling paths sharing the destination prefix.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubyzipto a version that resolves this vulnerability.Fixed in 3.4.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using rubyzip versions before 3.4.0 are exposed when they use Zip::Entry#extract to extract archive entries. The risk is relevant where a crafted archive can be supplied for extraction.
What does an attacker need to exploit this issue?
An attacker needs to provide a crafted archive containing an entry name such as ../upload_backup/owned.sh. The vulnerable prefix comparison can then allow writing to a sibling path outside the intended extraction directory.
How can I determine whether my application is affected?
Check whether the application uses a rubyzip release before 3.4.0 and calls Zip::Entry#extract. Also review whether its archive extraction workflow can process attacker-controlled or otherwise untrusted archives.
What is the available fix?
Upgrade rubyzip to version 3.4.0 or later. Version 3.4.0 is identified as the release containing the fix.