CVE-2019-5624

CVE-2019-5624 A proof of concept for Metasploit's CVE-2019-5624 vulnerability Rubyzip insecure ZIP handling RCE Intro In February 2019 I found a new vulnerability in the Rubyzip library. It allows an attacker to exploit insecure ZIP handling Zip Slip resulting in remote command execution. This...

rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix

...

Linux Distros Unpatched Vulnerability : CVE-2026-85396

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entryextract that fails to properly validate extraction paths using prefix comparis...

UBUNTU-CVE-2026-85396

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entryextract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../uploadbackup/owned.sh to write files outside the...

AZL-99087 CVE-2026-85396 affecting package rubygem-rubyzip 2.3.2-1

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entryextract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../uploadbackup/owned.sh to write files outside the...

CVE-2026-85396

A flaw was found in rubyzip. This path traversal vulnerability in the Zip::Entryextract function allows a remote attacker to craft malicious archive entries. By failing to properly validate extraction paths, the vulnerability enables an attacker to write files outside the intended extraction...

CVE-2026-85396

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract. The root cause is that extraction paths are validated using prefix comparison without trailing separators , allowing attackers to craft archive entries with names like ../upload_backup/owned.sh that bypass...

CVE-2026-85396

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entryextract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../uploadbackup/owned.sh to write files outside the...

EUVD-2026-70673

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entryextract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../uploadbackup/owned.sh to write files outside the...

CVE-2026-85396 rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entryextract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../uploadbackup/owned.sh to write files outside the...

CVE-2026-85396 rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entryextract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../uploadbackup/owned.sh to write files outside the...

PT-2026-85229

Name of the Vulnerable Software and Affected Versions rubyzip versions prior to 3.4.0 Description An issue exists in the Zip::Entryextract function that allows for path traversal. The software fails to properly validate extraction paths when using prefix comparison without trailing separators. Th...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: rubygem-rubyzip (UTSA-2026-093213)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093213 advisory. In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows...

ruby4.0-rubygem-rubyzip-2.3.2-1.19 on GA media (moderate)

ruby4.0-rubygem-rubyzip-2.3.2-1.19 on GA media Announcement ID: openSUSE-SU-2026:10363-1 Rating: moderate Cross-References: CVE-2017-5946 CVE-2018-1000544 Affected Products: openSUSE Tumbleweed An update that solves 2 vulnerabilities can now be installed. Description: These are all security issue...

OPENSUSE-SU-2026:10363-1 ruby4.0-rubygem-rubyzip-2.3.2-1.19 on GA media

These are all security issues fixed in the ruby4.0-rubygem-rubyzip-2.3.2-1.19 package on the GA media of openSUSE Tumbleweed...

EUVD-2017-0236

Malware in sbrugna...

EUVD-2018-0470

Malware in sbrugna...

Linux Distros Unpatched Vulnerability : CVE-2019-16892

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allow...

Linux Distros Unpatched Vulnerability : CVE-2017-5946

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker...

Linux Distros Unpatched Vulnerability : CVE-2018-1000544

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to th...