{"id":"CVE-2026-85396","aliases":["GHSA-47m2-wp7j-p9vc"],"url":"https://o3.security/vulnerability/CVE-2026-85396","summary":"rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix","details":"rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../upload_backup/owned.sh to write files outside the intended extraction directory into sibling paths sharing the destination prefix.","published":"2026-09-03T18:54:27.903Z","modified":"2026-09-26T03:30:49.074286179Z","cvss":null,"epss":{"score":0.00383,"percentile":0.31507,"asOf":"2026-09-06"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"RubyGems","name":"rubyzip","fixedVersion":"3.4.0"}],"fix":{"url":"https://github.com/rubyzip/rubyzip/commit/17edfbf4423b83211b075acc23a7d8640da63449","label":"rubyzip/rubyzip@17edfbf"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85396.json"},{"type":"ADVISORY","url":"https://github.com/rubyzip/rubyzip/releases/tag/v3.4.0"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85396"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/rubyzip-before-3.4.0-path-traversal-in-zip-entry-extract-via-sibling-directory-prefix"},{"type":"FIX","url":"https://github.com/rubyzip/rubyzip/commit/17edfbf4423b83211b075acc23a7d8640da63449"},{"type":"PACKAGE","url":"https://github.com/rubyzip/rubyzip"},{"type":"ARTICLE","url":"https://github.com/geo-chen/oss/blob/main/rubyzip.md"},{"type":"ARTICLE","url":"https://github.com/rubyzip/rubyzip/blob/v3.3.1/lib/zip/entry.rb"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubyzip/CVE-2026-85396.yml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-26T03:30:49.074286179Z"}}