CVE-2026-85396

rubyzip, a widely used Ruby gem for creating and extracting ZIP archives, contains a path traversal vulnerability (CWE-22) in Zip::Entry#extract in all versions before 3.4.0. Because the extraction path is validated using a prefix comparison without a trailing separator, crafted archive entries such as ../upload_backup/owned.sh pass validation and are written outside the intended extraction directory into sibling paths whose names share the destination prefix. An attacker who can supply a malicious ZIP archive to an application that extracts it gains a write outside the destination folder (high integrity impact per the CVSS 4.0 vector), which can lead to overwriting scripts, configs, or other files depending on the host application. Any Ruby application running an affected rubyzip version and extracting untrusted archives is affected; exploitation requires no privileges or user interaction over the network. There is currently no public proof-of-concept, no CISA KEV listing, and no known exploitation, with EPSS estimating roughly a 0.4% probability of exploitation within 30 days.

What to do: Upgrade to rubyzip 3.4.0 or later and review Gemfile.lock/dependency audits (e.g., bundler-audit) for affected versions. As interim mitigation, validate ZIP entry names before extraction (reject entries containing ../ components or paths resolving into sibling directories of the destination) and identify application code paths that call Zip::File#extract or Entry#extract on user-supplied archives.