GitHub Advisoryadvisory · RubyGems

GHSA-gcqq-w6gr-h9j9 Directory traversal vulnerability in RubyZip

CRITICAL Published 2017-10-24 Modified 2023-01-26 Official page ↗
Aliases
CVE-2017-5946
Ecosystem
RubyGems
Packages
rubyzip
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22
Reviewed
2020-06-16

Affected packages

• RubyGems rubyzip: < 1.2.1 → fixed in 1.2.1

Description

The `Zip::File` component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses `../` pathname substrings to write arbitrary files to the filesystem.

Related

Alias · CVE (1)

  • CVE-2017-5946 The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References