rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using… (CVE-2026-85396)

The vulnerability in rubyzip prior to version 3.4.0 involves improper validation of extraction paths in the Zip::Entry#extract method. The method uses prefix comparison without considering trailing separators, which can be bypassed by attackers crafting archive entries with relative paths such as '../upload_backup/owned.sh'. This allows files to be extracted outside the target directory, potentially overwriting or creating files in sibling directories. This is classified as a CWE-22 (Path Traversal) vulnerability.

An attacker can create a malicious zip archive that, when extracted using vulnerable rubyzip versions, writes files outside the intended extraction directory. This can lead to arbitrary file creation or overwriting, impacting the integrity of the system. The CVSS score of 7.5 reflects a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

A fix is available in rubyzip version 3.4.0 and later. Users should upgrade to rubyzip 3.4.0 or newer to remediate this vulnerability. Since no vendor advisory or patch links are provided, check the official rubyzip repository or vendor advisory for confirmation and further guidance. Patch status is not yet confirmed in the provided data — verify with the vendor advisory.