CVE-2017-5946: Directory traversal vulnerability

February 27, 2017 (updated November 4, 2017)

The Zip::File component in the rubyzip gem for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses ../ pathname substrings to write arbitrary files to the filesystem.

References

github.com/rubyzip/rubyzip/issues/315
nvd.nist.gov/vuln/detail/CVE-2017-5946

Code Behaviors & Features

Detect and mitigate CVE-2017-5946 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →