Description
In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | ruby | 2.7.3-r0 | — |
| Alpine v3.23 | ruby | 2.7.3-r0 | — |
| Alpine v3.22 | ruby | 2.7.3-r0 | — |
| Alpine v3.21 | ruby | 2.7.3-r0 | — |
| Alpine v3.20 | ruby | 2.7.3-r0 | — |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | ruby | 2.7.3-r0 | — |
| Alpine v3.18 | ruby | 2.7.3-r0 | — |
| Alpine v3.17 | ruby | 2.7.3-r0 | — |
| Alpine v3.16 | ruby | 2.7.3-r0 | — |
| Alpine v3.15 | ruby | 2.7.3-r0 | — |
| Alpine v3.14 | ruby | 2.7.3-r0 | — |
| Alpine v3.13 | ruby | 2.7.3-r0 | — |
| Alpine v3.12 | ruby | 2.7.3-r0 | — |
| Alpine v3.11 | ruby | 2.6.7-r0 | — |
| Alpine v3.10 | ruby | 2.5.9-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | tmpdir | < 0.1.2 | 0.1.2 | GHSA-46f2-3v63-3xrp |
Advisories 1
- WID-SEC-2023-2462 Ruby: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 7, 2026