Bug 2528185 (CVE-2026-85396)

Summary: CVE-2026-85396 rubyzip: rubyzip: Arbitrary file write via path traversal
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: akostadi, amasferr, crizzo, dmayorov, jlledo, pantinor, tsedmik
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in rubyzip. This path traversal vulnerability in the Zip::Entry#extract function allows a remote attacker to craft malicious archive entries. By failing to properly validate extraction paths, the vulnerability enables an attacker to write files outside the intended extraction directory, potentially leading to arbitrary file write.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2528457    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-03 19:02:53 UTC
rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../upload_backup/owned.sh to write files outside the intended extraction directory into sibling paths sharing the destination prefix.