CVE-2018-6914

—

CVSS 3.0

7.5 high

EPSS

10%p95

Published

Apr 3, 2018 (Apr 3, 2018)

Modified

Jun 17, 2026

Description

Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 might allow attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument.

Vendors: ruby-lang canonical debian redhat
Products: ruby, ubuntu linux, debian linux, enterprise linux
Weakness: CWE-22
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (10.3%)

In the news0 stories

No ingested article mentions this CVE yet.