Executive brief
rubyzip is a popular Ruby library for creating and extracting ZIP archive files. Versions before 3.4.0 contain a path traversal vulnerability that allows attackers to extract files outside the intended directory. When processing a specially crafted ZIP archive, files can be written to sibling directories, potentially overwriting sensitive files and compromising systems that extract untrusted archives.
Technical details
The vulnerability is a path traversal flaw in the Entry#extract method (lib/zip/entry.rb lines 289–303) that uses a simple string prefix check without a trailing separator to validate extraction paths. An attacker can craft a ZIP entry with a name like ../upload_backup/owned.sh; when extracting to a destination like /tmp/rzv/upload, the vulnerable code accepts /tmp/rzv/upload_backup/owned.sh because it starts with the prefix /tmp/rzv/upload. The flaw exists because the check does not require an exact match or a trailing directory separator. No authentication is required; the vulnerability is triggered whenever an application extracts a malicious ZIP archive. An attacker can write arbitrary files to sibling directories of the extraction target. The fix, available in version 3.4.0, requires either an exact path match or a trailing separator in the prefix check.
Affected products
- rubyzip rubyzip before 3.4.0
Timeline
- 2026-06-04: disclosed
- 2026-09-03: patched