Ruby RubyGems up to 4.0.12 Gem Extraction path traversal

Summaryinfo

A vulnerability identified as problematic has been detected in Ruby RubyGems up to 4.0.12. This impacts an unknown function of the component Gem Extraction. This manipulation causes path traversal. This vulnerability is handled as CVE-2026-82455. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability has been found in Ruby RubyGems up to 4.0.12 and classified as problematic. Affected by this vulnerability is some unknown functionality of the component Gem Extraction. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect integrity, and availability. The summary by CVE is:

RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be written outside of it, breaking the extraction safety boundary. The fix resolves the real path of the parent directory before writing and raises Gem::Package::PathError if it escapes the destination directory.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-82455 since 08/29/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

Upgrading to version 4.0.13 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Programming Language Software

Vendor

• Ruby

Name

• RubyGems

Version

• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 4.0.5
• 4.0.6
• 4.0.7
• 4.0.8
• 4.0.9
• 4.0.10
• 4.0.11
• 4.0.12

License

• open-source

Website

• Product: https://github.com/ruby/rubygems/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion