Description

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../upload_backup/owned.sh to write files outside the intended extraction directory into sibling paths sharing the destination prefix.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T19:17:31.527Z",
  "pubdate": "2026-09-03T19:17:31.527Z",
  "executiveSummary": "A path traversal vulnerability exists in the rubyzip library, specifically within the Zip::Entry#extract method, affecting all versions prior to 3.4.0.\nThe vulnerability arises from improper validation of archive entry file paths during the extraction process.\nBy crafting malicious archive entries containing directory traversal sequences such as '../', an attacker can escape the intended destination directory.\nThis flaw allows for unauthorized file system writes, enabling attackers to overwrite existing files or place arbitrary payloads in locations outside the target extraction path, potentially leading to remote code execution or system compromise.\nExploitation does not require authentication, as the attack is triggered when the application processes a maliciously crafted ZIP archive.\nThe risk is high for any application that automatically extracts user-supplied ZIP files, as it grants attackers the ability to manipulate the host filesystem relative to the execution context of the Ruby application.",
  "technicalDetails": "The root cause of this vulnerability lies in an insufficient security check within the Zip::Entry#extract method, which utilizes a flawed prefix comparison mechanism. When validating the target path for an extracted entry, the library fails to account for the absence of a trailing directory separator when comparing the destination path against the intended extraction base directory.\nIn a secure implementation, an extraction path must be strictly constrained to reside within the intended root directory. The vulnerability occurs because the validation logic incorrectly validates paths that share a common prefix with the destination directory but deviate into sibling directories. Specifically, if an attacker provides a filename like '../upload_backup/owned.sh', the insecure prefix check may perceive this as valid if the destination directory contains a directory name that partially matches the malicious path prefix.\nThe attack flow proceeds as follows: 1) An attacker creates a ZIP archive containing entries with crafted paths that include traversal sequences (e.g., '../'). 2) The victim application utilizes the vulnerable rubyzip version to call Zip::Entry#extract on the provided archive. 3) The extraction logic processes the entry name without correctly sanitizing or resolving the path against the target directory. 4) The deficient prefix comparison fails to detect the traversal sequence, allowing the file system write operation to escape the sandbox. 5) The file is written to an unauthorized location on the host file system.\nBecause the vulnerability exists in the core extraction logic of the rubyzip library, it affects all applications relying on these affected versions (before 3.4.0) to handle ZIP file extraction. No specific privilege requirements exist beyond the file system permissions of the Ruby process itself; the application inherits the process owner's ability to write to the targeted locations. This makes it a critical concern for automated upload-and-process workflows, such as backup systems, file management plugins, or archive processing services, where user-provided input is implicitly trusted during the extraction phase."
}