CVE-2026-85396 in rubyzip
Summary
by MITRE • 09/03/2026
rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../upload_backup/owned.sh to write files outside the intended extraction directory into sibling paths sharing the destination prefix.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/03/2026
The RubyZip library, a widely used gem for handling ZIP archives in Ruby applications, contained a critical path traversal vulnerability in versions prior to 3.4.0 affecting the Zip::Entry#extract method. This flaw stems from an insufficient validation mechanism when determining whether a file entry within a compressed archive should be extracted into a specified target directory. The core issue lies in how the library checks for prefix matching between the intended extraction path and the normalized path of each archive member. Specifically, the implementation failed to ensure that the comparison included trailing separators or accounted for directory boundaries correctly. This oversight allows an attacker to craft malicious ZIP archives containing entries with names such as ../upload_backup/owned.sh, which can successfully bypass the security checks designed to keep extracted files within the designated sandboxed directory.
From a technical perspective, this vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The root cause is an incorrect string comparison logic where the library verifies if the entry path starts with the target extraction prefix but does not strictly enforce that the match occurs at a directory boundary. For instance, if the intended extraction directory is /tmp/uploads and the attacker provides an archive containing ../uploads/evil.txt, the naive prefix check might incorrectly validate this as safe because it shares the substring uploads without recognizing that it actually points to a sibling or parent directory structure depending on how normalization handles relative paths. This lack of rigorous boundary checking enables arbitrary file write operations outside the intended context, potentially overwriting critical system files, injecting web shells into accessible directories, or disrupting application integrity by modifying configuration files located in adjacent folders.
The operational impact of this vulnerability is severe for any Ruby-based service that processes user-uploaded ZIP archives without additional external sanitization layers. Attackers can exploit this flaw to achieve remote code execution if they manage to write executable scripts into web-accessible directories and subsequently trigger their execution through other application features or server configurations. Even in scenarios where direct code execution is not immediately possible, the ability to overwrite arbitrary files within the file system hierarchy poses significant risks including data integrity compromise, denial of service through deletion or corruption of essential resources, and potential privilege escalation if the vulnerable process runs with elevated permissions. This type of attack vector aligns closely with MITRE ATT&CK technique T1059 Command and Scripting Interpreter when used to deploy payloads, as well as T1486 Data Encrypted for Impact in cases where critical files are corrupted or encrypted by an attacker gaining write access through this flaw.
To mitigate this vulnerability, organizations must immediately upgrade the RubyZip gem to version 3.4.0 or later, which addresses these path validation issues by implementing stricter checks that ensure extracted paths remain strictly within the intended directory boundaries using proper separator-aware comparisons. For applications unable to update immediately due to dependency constraints, defensive coding practices should be employed such as manually validating extraction paths before calling extract methods, ensuring that resolved absolute paths do not escape the target root directory. Additionally, integrating robust input validation and employing allow-lists for acceptable file types can provide an additional layer of defense against malicious archive contents. Regular security audits and static code analysis tools configured to detect path traversal patterns are also recommended to identify similar weaknesses in custom extraction logic across the application ecosystem.