Is CVE-2026-85396 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85396 being exploited in the wild.

How severe is CVE-2026-85396?

High severity, with a CVSS score of 7.5, published 3 September 2026.

Which products and versions are affected?

rubyzip (RubyGems) ECOSYSTEM:introduced=0,fixed=3.4.0.

Is there a fix for CVE-2026-85396?

Yes. rubyzip (RubyGems): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-85396 attacked?

It is attacked over the network.

Am I affected by CVE-2026-85396?

Check whether you run rubyzip (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85396: rubyzip path traversal in Entry#extract

CVE-2026-85396 · Severity: high · CVSS 7.5 · Published 2026-09-03

rubyzip is a popular Ruby library for creating and extracting ZIP archive files. Versions before 3.4.0 contain a path traversal vulnerability that allows attackers to extract files outside the intended directory. When processing a specially crafted ZIP archive, files can be written to sibling directories, potentially overwriting sensitive files and compromising systems that extract untrusted archives.

Technologies: rubyzip (RubyGems). Vendors: RubyGems.

Quick answers

Is CVE-2026-85396 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85396 being exploited in the wild.
How severe is CVE-2026-85396?: High severity, with a CVSS score of 7.5, published 3 September 2026.
Which products and versions are affected?: rubyzip (RubyGems) ECOSYSTEM:introduced=0,fixed=3.4.0.
Is there a fix for CVE-2026-85396?: Yes. rubyzip (RubyGems): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85396 attacked?: It is attacked over the network.
Am I affected by CVE-2026-85396?: Check whether you run rubyzip (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

rubyzip (RubyGems): upgrade to 3.4.0 or later
```
bundle update rubyzip
```

Technical details

The vulnerability is a path traversal flaw in the Entry#extract method (lib/zip/entry.rb lines 289–303) that uses a simple string prefix check without a trailing separator to validate extraction paths. An attacker can craft a ZIP entry with a name like ../upload_backup/owned.sh; when extracting to a destination like /tmp/rzv/upload, the vulnerable code accepts /tmp/rzv/upload_backup/owned.sh because it starts with the prefix /tmp/rzv/upload. The flaw exists because the check does not require an exact match or a trailing directory separator. No authentication is required; the vulnerability is triggered whenever an application extracts a malicious ZIP archive. An attacker can write arbitrary files to sibling directories of the extraction target. The fix, available in version 3.4.0, requires either an exact path match or a trailing separator in the prefix check.

Affected products

rubyzip rubyzip before 3.4.0

Identifiers

CVE-2026-85396
GHSA-47m2-wp7j-p9vc

Timeline

2026-06-04: disclosed
2026-09-03: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.