https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 05:11:14 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-85396 <p>rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../upload_backup/owned.sh to write files outside the intended extraction directory into sibling paths sharing the destination prefix.</p> <p>rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../upload_backup/owned.sh to write files outside the intended extraction directory into sibling paths sharing the destination prefix.</p> https://db.gcve.eu/vuln/fkie_cve-2026-85396 https://db.gcve.eu/vuln/ghsa-47m2-wp7j-p9vc <p><strong>Affected:</strong> RubyGems: rubyzip</p> <p>rubyzip versions before 3.4.0 contain a path traversal vulnerability in `Zip::Entry#extract` that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like `../upload_backup/owned.sh` to write files outside the intended extraction directory into sibling paths sharing the destination prefix.</p> <p><strong>Affected:</strong> RubyGems: rubyzip</p> <p>rubyzip versions before 3.4.0 contain a path traversal vulnerability in `Zip::Entry#extract` that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like `../upload_backup/owned.sh` to write files outside the intended extraction directory into sibling paths sharing the destination prefix.</p> https://db.gcve.eu/vuln/ghsa-47m2-wp7j-p9vc https://db.gcve.eu/vuln/msrc_cve-2026-85396 msrc_CVE-2026-85396 https://db.gcve.eu/vuln/msrc_cve-2026-85396 https://db.gcve.eu/vuln/ubuntu-cve-2026-85396 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: ruby-zip, Ubuntu:18.04:LTS: ruby-zip, Ubuntu:20.04:LTS: ruby-zip, Ubuntu:22.04:LTS: ruby-zip, Ubuntu:24.04:LTS: ruby-zip, Ubuntu:26.04:LTS: ruby-zip</p> <p>rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../upload_backup/owned.sh to write files outside the intended extraction directory into sibling paths sharing the destination prefix.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: ruby-zip, Ubuntu:18.04:LTS: ruby-zip, Ubuntu:20.04:LTS: ruby-zip, Ubuntu:22.04:LTS: ruby-zip, Ubuntu:24.04:LTS: ruby-zip, Ubuntu:26.04:LTS: ruby-zip</p> <p>rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../upload_backup/owned.sh to write files outside the intended extraction directory into sibling paths sharing the destination prefix.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-85396