CVE-2026-85396

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-85396", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-09-03T18:10:59.168Z", "datePublished": "2026-09-03T18:54:27.903Z", "dateUpdated": "2026-09-03T19:00:09.867Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-03T18:54:27.903Z"}, "datePublic": "2026-06-12T00:00:00.000Z", "title": "rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix", "descriptions": [{"lang": "en", "value": "rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../upload_backup/owned.sh to write files outside the intended extraction directory into sibling paths sharing the destination prefix."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "cweId": "CWE-22", "type": "CWE"}]}], "affected": [{"vendor": "rubyzip", "product": "rubyzip", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "3.4.0", "status": "affected", "versionType": "semver"}, {"version": "3.4.0", "status": "unaffected", "versionType": "semver"}], "packageURL": "pkg:gem/rubyzip"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:rubyzip_project:rubyzip:*:*:*:*:*:*:*:*", "versionEndExcluding": "3.4.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/rubyzip/rubyzip/commit/17edfbf4423b83211b075acc23a7d8640da63449", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/rubyzip/rubyzip", "tags": ["product"]}, {"url": "https://github.com/rubyzip/rubyzip/releases/tag/v3.4.0", "tags": ["release-notes"], "name": "rubyzip v3.4.0 Release Notes"}, {"url": "https://github.com/rubyzip/rubyzip/blob/v3.3.1/lib/zip/entry.rb", "tags": ["technical-description"]}, {"url": "https://github.com/geo-chen/oss/blob/main/rubyzip.md", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/rubyzip-before-3.4.0-path-traversal-in-zip-entry-extract-via-sibling-directory-prefix"}], "credits": [{"lang": "en", "value": "George Chen", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-03T18:59:39.190691Z", "id": "CVE-2026-85396", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-03T19:00:09.867Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-85396", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-03T18:59:39.190691Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-03T19:00:04.473Z"}}], "cna": {"title": "rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix", "credits": [{"lang": "en", "type": "finder", "value": "George Chen"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "rubyzip", "product": "rubyzip", "versions": [{"status": "affected", "version": "0", "lessThan": "3.4.0", "versionType": "semver"}, {"status": "unaffected", "version": "3.4.0", "versionType": "semver"}], "packageURL": "pkg:gem/rubyzip", "defaultStatus": "unaffected"}], "datePublic": "2026-06-12T00:00:00.000Z", "references": [{"url": "https://github.com/rubyzip/rubyzip/commit/17edfbf4423b83211b075acc23a7d8640da63449", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://github.com/rubyzip/rubyzip", "tags": ["product"]}, {"url": "https://github.com/rubyzip/rubyzip/releases/tag/v3.4.0", "name": "rubyzip v3.4.0 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/rubyzip/rubyzip/blob/v3.3.1/lib/zip/entry.rb", "tags": ["technical-description"]}, {"url": "https://github.com/geo-chen/oss/blob/main/rubyzip.md", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/rubyzip-before-3.4.0-path-traversal-in-zip-entry-extract-via-sibling-directory-prefix", "name": "VulnCheck Advisory: rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../upload_backup/owned.sh to write files outside the intended extraction directory into sibling paths sharing the destination prefix."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rubyzip_project:rubyzip:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "3.4.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-03T18:54:27.903Z"}}}, "cveMetadata": {"cveId": "CVE-2026-85396", "state": "PUBLISHED", "dateUpdated": "2026-09-03T19:00:09.867Z", "dateReserved": "2026-09-03T18:10:59.168Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-09-03T18:54:27.903Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:gem/rubyzip", "product": "rubyzip", "vendor": "rubyzip", "versions": [{"lessThan": "3.4.0", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "3.4.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../upload_backup/owned.sh to write files outside the intended extraction directory into sibling paths sharing the destination prefix."}], "id": "CVE-2026-85396", "lastModified": "2026-09-24T20:28:01.780", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-85396", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-03T18:59:39.190691Z", "version": "2.0.3"}}]}, "published": "2026-09-03T19:17:31.527", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/geo-chen/oss/blob/main/rubyzip.md"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/rubyzip/rubyzip"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/rubyzip/rubyzip/blob/v3.3.1/lib/zip/entry.rb"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/rubyzip/rubyzip/commit/17edfbf4423b83211b075acc23a7d8640da63449"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/rubyzip/rubyzip/releases/tag/v3.4.0"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/rubyzip-before-3.4.0-path-traversal-in-zip-entry-extract-via-sibling-directory-prefix"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{"bugzilla": {"description": "rubyzip: rubyzip: Arbitrary file write via path traversal", "id": "2528185", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528185"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-22", "details": ["A flaw was found in rubyzip. This path traversal vulnerability in the Zip::Entry#extract function allows a remote attacker to craft malicious archive entries. By failing to properly validate extraction paths, the vulnerability enables an attacker to write files outside the intended extraction directory, potentially leading to arbitrary file write."], "name": "CVE-2026-85396", "package_state": [{"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Affected", "package_name": "3scale-amp2/backend-rhel8", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Affected", "package_name": "3scale-amp2/system-rhel8", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Affected", "package_name": "3scale-amp2/system-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Affected", "package_name": "3scale-amp2/toolbox-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}], "public_date": "2026-09-03T18:54:27Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-85396\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-85396\nhttps://github.com/geo-chen/oss/blob/main/rubyzip.md\nhttps://github.com/rubyzip/rubyzip\nhttps://github.com/rubyzip/rubyzip/blob/v3.3.1/lib/zip/entry.rb\nhttps://github.com/rubyzip/rubyzip/commit/17edfbf4423b83211b075acc23a7d8640da63449\nhttps://github.com/rubyzip/rubyzip/releases/tag/v3.4.0\nhttps://www.vulncheck.com/advisories/rubyzip-before-3.4.0-path-traversal-in-zip-entry-extract-via-sibling-directory-prefix"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.4.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "3.4.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "rubyzip", "source": "cna", "vendor": "rubyzip"}, "product": "rubyzip", "vendor": "rubyzip"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "rubyzip", "vendor": "rubyzip_project"}], "created": "2026-09-03T21:15:04.564475+00:00", "updated": "2026-09-04T15:22:19.701852+00:00", "vendors": ["rubyzip", "rubyzip$PRODUCT$rubyzip", "rubyzip_project", "rubyzip_project$PRODUCT$rubyzip"]}