Description

RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be written outside of it, breaking the extraction safety boundary. The fix resolves the real path of the parent directory before writing and raises Gem::Package::PathError if it escapes the destination directory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-29T14:16:38.623Z",
  "pubdate": "2026-08-29T14:16:38.623Z",
  "executiveSummary": "This vulnerability is an arbitrary file write flaw stemming from inadequate path validation within the RubyGems package extraction process. The issue arises when the extraction logic fails to correctly re-validate path containment following filesystem symlink resolution.\nBy crafting a malicious gem archive containing symlinks that point outside the intended extraction root, an attacker can bypass security boundary checks. When the extraction process encounters these pre-existing symlinks, it inadvertently follows them to write files to unauthorized locations on the host filesystem.\nThe impact of this vulnerability is significant, as it permits an attacker to overwrite sensitive system files, modify application configurations, or place malicious executables, potentially leading to arbitrary code execution or privilege escalation depending on the environment and the privileges of the user running the gem command.\nThis vulnerability affects RubyGems environments where gem installation or extraction is performed without robust canonicalization of destination paths. It does not require specific network exposure but relies on the victim triggering an installation process for a maliciously crafted gem. Defense requires strict enforcement of path sanitization to ensure all extracted artifacts remain confined within the designated extraction directory.",
  "technicalDetails": "The root cause of this vulnerability lies in an insufficient verification mechanism during the file extraction phase within RubyGems. While the system attempts to enforce a safety boundary to prevent path traversal, the implementation fails to account for filesystem symlinks that exist within the destination directory before the extraction process begins.\nThe attack flow follows a structured exploitation path. First, an attacker constructs a malicious gem package that includes at least one symlink targeting a sensitive path outside the intended extraction root (e.g., ../../../home/user/.ssh/authorized_keys). Second, the attacker ensures that the target directory contains a pre-existing structure that facilitates the resolution of this symlink during the extraction sequence.\nWhen the RubyGems extraction routine attempts to write files, it fails to perform a secondary validation of the canonicalized path after the operating system resolves the symlinks. Because the validation check occurs on the raw path string rather than the post-resolution absolute path, the system incorrectly assumes the file is being written within the safe destination directory.\nOnce the file write operation is initiated, the kernel follows the symlink, effectively escaping the extraction root. This allows the attacker to write arbitrary file content to any location reachable by the user account executing the RubyGems process. The vulnerability essentially turns a restricted file write operation into a broad arbitrary write primitive.\nThe vulnerable component is the gem extraction logic responsible for validating file paths against the destination root. Exploitation requires no special authentication, as the mechanism is triggered by the standard installation or unpacking of a gem. The risk is heightened when RubyGems is executed by privileged users or automated CI/CD pipelines that handle third-party gems.\nThe remediation involves upgrading the extraction logic to perform a realpath resolution of the parent directory before the write operation commences. By canonicalizing the path and comparing the resulting directory against the intended root boundary, the system can definitively identify and raise a Gem::Package::PathError when an escape attempt is detected, thereby preventing the write operation from completing."
}