Search

Find merged stories by title or summary.

CVE-2026-85396 - rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix

CVE ID : CVE-2026-85396 Published : Sept. 3, 2026, 7:17 p. m. • 1 hour, 23 minutes ago Description : rubyzip versions before 3. 4. 0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like .. /upload_backup/owned. sh to write files outside the intended extraction directory into sibling paths sharing the destination prefix. Severity: 8.7 • HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Sep 3·CVEFeed

Read →

You've reached the end of current stories for this search.