CVE-2022-31163 TZInfo relative path traversal vulnerability allows loading of arbitrary files

🗓️ 21 Jul 2022 13:30:16Reported by GoogleType

osv🔗 osv.dev👁 27 Views

TZInfo Ruby library allows relative path traversal in versions prior to 0.36.1 and 1.2.10 with tzinfo-data, leading to execution of unintended files

Reporter	Title	Published	Views	Family All 55
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data is vulnerable to multiple Vulnerabilities due to Ruby package	20 Jun 202506:47	–	ibm
ATTACKERKB	CVE-2022-31163	22 Jul 202204:15	–	attackerkb
AstraLinux	Astra Linux - уязвимость в ruby-tzinfo	20 May 202605:53	–	astralinux
CNNVD	TZInfo 安全漏洞	22 Jul 202200:00	–	cnnvd
CVE	CVE-2022-31163	21 Jul 202213:30	–	cve
Cvelist	CVE-2022-31163 TZInfo relative path traversal vulnerability allows loading of arbitrary files	21 Jul 202213:30	–	cvelist
Debian	[SECURITY] [DLA 3077-1] ruby-tzinfo security update	18 Aug 202217:46	–	debian
Debian	[SECURITY] [DLA 3866-1] ruby-tzinfo security update	3 Sep 202408:10	–	debian
Debian CVE	CVE-2022-31163	21 Jul 202213:30	–	debiancve
Tenable Nessus	Debian DLA-3077-1 : ruby-tzinfo - LTS security update	18 Aug 202200:00	–	nessus

Source	Link
github	www.github.com/tzinfo/tzinfo/releases/tag/v0.3.61
github	www.github.com/tzinfo/tzinfo/releases/tag/v1.2.10
lists	www.lists.debian.org/debian-lts-announce/2024/09/msg00008.html
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31163.json
github	www.github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-31163
github	www.github.com/tzinfo/tzinfo/commit/9905ca93abf7bf3e387bd592406e403cd18334c7
github	www.github.com/tzinfo/tzinfo/commit/9eddbb5c0e682736f61d0dd803b6031a5db9eadf
lists	www.lists.debian.org/debian-lts-announce/2022/08/msg00009.html

10 Apr 2026 04:47Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.17.5

EPSS0.03833