Skip to content
OpenAdvisories

Package · Debian

ruby-zip

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 7.5
    CVE-2026-85396

    rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix

    rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../upload_back…

    rubyzip rubyzip ruby-zip rubyzip Debian Ubuntu RubyGems
  • Medium 5.5
    CVE-2019-16892

    Rubyzip denial of service

    In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).

    rubyzip ruby-zip ruby-zip Debian Ubuntu RubyGems
  • Critical 9.8
    CVE-2018-1000544

    Rubyzip gem contains a Directory Traversal vulnerability in zip file component

    rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , a…

    ruby-zip ruby-zip rubyzip Debian Ubuntu RubyGems
  • Critical 9.8
    CVE-2017-5946

    Directory traversal vulnerability in RubyZip

    The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses "../" pathname substrings to write arbitrary files to the fil…

    rubyzip ruby-zip ruby-zip Debian Ubuntu RubyGems