CVE-2026-85396: rubyzip path traversal vulnerability
(updated )
rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../upload_backup/owned.sh to write files outside the intended extraction directory into sibling paths sharing the destination prefix.
References
- github.com/advisories/GHSA-47m2-wp7j-p9vc
- github.com/geo-chen/oss/blob/main/rubyzip.md
- github.com/rubysec/ruby-advisory-db/blob/master/gems/rubyzip/CVE-2026-85396.yml
- github.com/rubyzip/rubyzip/blob/v3.3.1/lib/zip/entry.rb
- github.com/rubyzip/rubyzip/commit/17edfbf4423b83211b075acc23a7d8640da63449
- github.com/rubyzip/rubyzip/releases/tag/v3.4.0
- nvd.nist.gov/vuln/detail/CVE-2026-85396
- www.vulncheck.com/advisories/rubyzip-before-3.4.0-path-traversal-in-zip-entry-extract-via-sibling-directory-prefix
Code Behaviors & Features
Detect and mitigate CVE-2026-85396 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →