{"id":"CVE-2026-85396","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-85396","summary":"rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison without trailing…","details":"rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../upload_backup/owned.sh to write files outside the intended extraction directory into sibling paths sharing the destination prefix.","published":"2026-09-03T19:17:31.527","modified":"2026-09-03T19:17:31.527","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/rubyzip/rubyzip/commit/17edfbf4423b83211b075acc23a7d8640da63449","label":"rubyzip/rubyzip@17edfbf"},"references":[{"type":"WEB","url":"https://github.com/geo-chen/oss/blob/main/rubyzip.md"},{"type":"WEB","url":"https://github.com/rubyzip/rubyzip"},{"type":"WEB","url":"https://github.com/rubyzip/rubyzip/blob/v3.3.1/lib/zip/entry.rb"},{"type":"WEB","url":"https://github.com/rubyzip/rubyzip/commit/17edfbf4423b83211b075acc23a7d8640da63449"},{"type":"WEB","url":"https://github.com/rubyzip/rubyzip/releases/tag/v3.4.0"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/rubyzip-before-3.4.0-path-traversal-in-zip-entry-extract-via-sibling-directory-prefix"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-09-03T19:17:31.527"}}