CVE-2026-82455: 
RubyGems vulnerability analysis and mitigation

CVE-2026-82455 is a symlink-following (link following) vulnerability in RubyGems that allows a local attacker to write arbitrary files outside the intended gem extraction directory by exploiting pre-existing symlinks. It was reported privately, initially declined by the RubyGems maintainers, and subsequently assigned by VulnCheck; the CVE record was later marked Rejected after RubyGems disputed the assignment, asserting the behavior does not constitute a security vulnerability (GitHub Advisory). The affected version range is RubyGems 3.2.30 through versions before 4.0.13 (ENISA EUVD). The originally published CVSS v3.1 base score was 7.1 (High) and CVSS v4.0 base score was 6.9 (Medium) (Feedly).

The root cause is CWE-59 (Improper Link Resolution Before File Access — 'Link Following'). During gem extraction in Gem::Package#extract_tar_gz, RubyGems correctly rejects obvious path traversal patterns (absolute paths, .. components) but does not re-validate path containment after filesystem symlink resolution. If a pre-existing symlink inside the destination directory points outside the extraction root, a file that appears to be written under destination_dir is instead written to the symlink's target outside that root, breaking the extraction safety boundary (GitHub PR #9493). The fix, merged in commit 103ca42, adds a File.realpath-based containment check on the parent directory before writing each extracted file, raising Gem::Package::PathError if the resolved path escapes destination_dir (GitHub Commit).

A local user who can trigger gem extraction in a reused or shared directory containing a pre-existing symlink pointing outside the extraction root can write arbitrary files to attacker-controlled locations on the filesystem. This could result in overwriting system files, application code, or configuration files, potentially escalating to code execution. Confidentiality impact is assessed as none; integrity and availability impacts are rated high (ENISA EUVD, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Feedly). The EPSS score is approximately 0.0014 (0.14%), indicating a very low probability of exploitation in the near term. The CVE record has been marked Rejected by the CVE Program following a dispute by the RubyGems maintainers, who determined the symlink-following behavior does not meet their threat model for a security vulnerability (GitHub PR #9493). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Reconnaissance: Identify a system running RubyGems 3.2.30 through 4.0.12 where a local user can trigger gem extraction into a shared or reused directory.
2. Plant a symlink: Before extraction occurs, create a symlink inside the intended extraction destination directory (e.g., destination_dir/lib) that points to a directory outside the extraction root (e.g., /etc or /var/www/app).
3. Trigger gem extraction: Cause the target system to extract a gem containing a file whose path traverses the symlinked directory (e.g., lib/owned.txt). This can be done by installing a crafted gem or by triggering an existing gem install/unpack operation.
4. Arbitrary file write: Because RubyGems does not re-validate path containment after resolving the symlink, the extracted file is written to the symlink's real target outside the extraction root (e.g., /etc/owned.txt or /var/www/app/owned.txt).
5. Achieve objective: Depending on the target path and file content, the attacker can overwrite configuration files, inject malicious code into application directories, or corrupt system files to achieve code execution or denial of service (GitHub PR #9493, GitHub Commit).

• File System: Unexpected files appearing in directories outside the gem extraction root (e.g., /etc/, /var/www/, or other sensitive paths) with timestamps coinciding with gem installation or extraction activity; symlinks inside gem destination directories (e.g., GEM_HOME/gems/<name>/lib) pointing to locations outside the gem tree.
• Logs: System package manager or gem install logs showing extraction of gems into shared or world-writable directories; Gem::Package::PathError exceptions in Ruby application logs (on patched systems, indicating an attempted exploit).
• Process: Unexpected gem install, gem unpack, or Bundler processes running as privileged users in shared directory contexts; file write events to sensitive paths triggered by Ruby gem extraction processes (detectable via auditd or similar file integrity monitoring).

Upgrade RubyGems to version 4.0.13 or later, which includes the fix that resolves the real path of the parent directory before writing extracted files and raises Gem::Package::PathError if the path escapes the destination directory (GitHub PR #9493, GitHub Commit). As a workaround, restrict local access to gem extraction processes and avoid extracting gems into shared or reused directories that may contain pre-existing symlinks. Validate symlink targets in extraction directories before running gem install or unpack operations. Microsoft has also issued guidance for the affected azl3_ruby_3.3.5-9 package (Microsoft MSRC).

The CVE assignment generated notable controversy between the researcher (thesmartshadow), the RubyGems maintainers, and VulnCheck. The RubyGems maintainer (hsbt) stated that the behavior was not considered a security vulnerability due to the threat model — specifically, that no privilege escalation occurs — and requested VulnCheck reject the CVE record (GitHub PR #9493). The researcher defended the assignment, citing the demonstrable out-of-root file write and arguing that integrity impact and policy violation are sufficient grounds for CVE assignment independent of privilege escalation. The CVE was ultimately marked Rejected. The fix itself was merged upstream as a non-security enhancement (GitHub PR #9493).