CVE-2017-5946: Directory Traversal Vulnerability in RubyZip
Summary
CVE-2017-5946: Directory traversal vulnerability in RubyZip. Affects rubyzip versions < 1.2.1. Fixed in 1.2.1. How to fix ↓
Also tracked for
- ruby-zip · Debian:11
The same CVE-2017-5946 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
RubyZip is a Ruby gem that provides a convenient interface for creating, reading, and extracting ZIP archives. It is commonly used in Ruby applications that involve file compression and decompression. However, versions prior to 1.2.1 of the rubyzip gem are susceptible to a directory traversal vulnerability. This vulnerability allows an attacker to upload a malicious .zip file that utilizes '../' pathname substrings to write arbitrary files to the filesystem. This can lead to unauthorized access, data leakage, and potential remote code execution.
Vulnerability Detail
The directory traversal vulnerability in RubyZip arises from insufficient input validation when handling user-supplied file paths within ZIP archives. By including '../' in the file path, an attacker can traverse directories and write files outside of the intended destination. This can be exploited when a site allows the uploading of .zip files, enabling an attacker to upload a malicious archive and execute arbitrary code on the target system. The impact of this vulnerability can be severe, as it grants unauthorized access to sensitive files and can potentially compromise the entire system.
How To Fix
Latest published version: 3.7.0 as of 23 Oct 2026
gem install rubyzip -v 3.7.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.1
This is the first release that contains the fix.
gem install rubyzip -v 1.2.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of the rubyzip gem is not immediately feasible, a temporary workaround is to implement strict input validation on the file paths provided by users. This can involve checking for the presence of '../' or any other directory traversal patterns and rejecting such inputs. Additionally, it is crucial to ensure that the extracted files are stored in a secure location with restricted access permissions.
Conclusion
The directory traversal vulnerability in RubyZip (CVE-2017-5946) poses a significant risk to applications that allow the uploading and processing of .zip files. Upgrading to version 1.2.1 or later of the rubyzip gem is strongly advised to address this vulnerability. In the meantime, implementing strict input validation and ensuring secure storage of extracted files can serve as temporary mitigations. Prompt action is essential to prevent unauthorized access, data leakage, and potential remote code execution. For further support and guidance, contact DevNack.com.
See every vulnerability recorded for rubyzip →
FAQ
The vulnerability allows an attacker to write arbitrary files to the filesystem, potentially leading to unauthorized access, data leakage, and remote code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Yes, the CVSS score for this vulnerability is 9.8, indicating its critical severity.
Specific instances of exploitation may vary, but directory traversal vulnerabilities are commonly targeted by attackers. It is crucial to promptly address this vulnerability to mitigate the risk of exploitation.
For further support on vulnerability remediation and assistance in securing your application, you can reach out to info@devnack.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for rubyzip.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
