Bug 2528185 (CVE-2026-85396)
| Summary: | CVE-2026-85396 rubyzip: rubyzip: Arbitrary file write via path traversal | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | akostadi, amasferr, crizzo, dmayorov, jlledo, pantinor, tsedmik |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in rubyzip. This path traversal vulnerability in the Zip::Entry#extract function allows a remote attacker to craft malicious archive entries. By failing to properly validate extraction paths, the vulnerability enables an attacker to write files outside the intended extraction directory, potentially leading to arbitrary file write.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2528457 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-09-03 19:02:53 UTC
|