Fluid Attacks Database

Description

rubyzip path traversal vulnerability rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../upload_backup/owned.sh to write files outside the intended extraction directory into sibling paths sharing the destination prefix.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 13	ruby-zip	=2.3.2-1 \|\| =3.2.2+dfsg-1 \|\| =3.2.2-1 \|\| =3.2.2-2 \|\| =3.4.0+dfsg-1 \|\| =3.4.1+dfsg-1 \|\| =3.5.0+dfsg-1 \|\| =3.7.0+dfsg-1	-
debian 14	ruby-zip	=2.3.2-1 \|\| =3.2.2+dfsg-1 \|\| =3.2.2-1 \|\| =3.2.2-2 \|\| >=0 <3.4.0+dfsg-1	3.4.0+dfsg-1
debian 12	ruby-zip	=2.3.2-1 \|\| =3.2.2+dfsg-1 \|\| =3.2.2-1 \|\| =3.2.2-2 \|\| =3.4.0+dfsg-1 \|\| =3.4.1+dfsg-1 \|\| =3.5.0+dfsg-1 \|\| =3.7.0+dfsg-1	-
rubygems	rubyzip	>=0 <3.4.0	3.4.0

Aliases

1. CVE-2026-853962. NVD-2026-853963. OSV-DEBIAN-2026-853964. OSV-2026-853965. GCVE-2026-853966. SECURITY-TRACKER-CVE-2026-85396

References

1. https://github.com/rubyzip/rubyzip/commit/17edfbf4423b83211b075acc23a7d8640da634492. https://github.com/geo-chen/oss/blob/main/rubyzip.md3. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubyzip/CVE-2026-85396.yml4. https://github.com/rubyzip/rubyzip/blob/v3.3.1/lib/zip/entry.rb5. https://github.com/rubyzip/rubyzip/releases/tag/v3.4.06. https://www.vulncheck.com/advisories/rubyzip-before-3.4.0-path-traversal-in-zip-entry-extract-via-sibling-directory-prefix

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.