CVE-2026-85396: 
Ruby vulnerability analysis and mitigation

CVE-2026-85396 is a path traversal vulnerability in the rubyzip Ruby library affecting all versions before 3.4.0. The flaw exists in the Zip::Entry#extract method, which fails to properly validate extraction paths by using a prefix comparison without a trailing directory separator, allowing crafted archive entries (e.g., ../upload_backup/owned.sh) to write files outside the intended extraction directory into sibling paths that share the destination prefix. It was reported on June 4, 2026, and publicly disclosed on September 3, 2026, with a patch released in rubyzip v3.4.0. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (Red Hat CVE, GitHub Advisory).

The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). In lib/zip/entry.rb, the vulnerable check extract_path.start_with?(dest_dir) does not append ::File::SEPARATOR to dest_dir, so a destination directory like /tmp/rzv/upload would incorrectly accept an extraction path of /tmp/rzv/upload_backup/owned.sh because the latter string begins with the former prefix. The check_name method only blocks entry names starting with / or exceeding length limits, and the existing name_safe? helper is never invoked during extraction. The fix in commit 17edfbf changes the guard to extract_path.start_with?(dest_dir + ::File::SEPARATOR) || dest_dir == ::File::SEPARATOR, requiring an exact separator boundary (Patch Commit, Researcher Write-up).

An unauthenticated attacker who can supply a malicious ZIP archive for extraction can write arbitrary files outside the intended extraction directory into sibling paths, with no impact on confidentiality or availability but a high integrity impact. Depending on the application's file permissions and extraction context, this could allow overwriting application source files, configuration files, shell scripts, or cron jobs, potentially escalating to remote code execution if executable files are replaced. The attack is network-deliverable, requires no privileges or user interaction, and is automatable, making it particularly dangerous in web applications that accept user-uploaded archives (Red Hat CVE, GitHub Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of active in-the-wild exploitation as of the disclosure date. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.0, and NVD SSVC assessment classifies exploitation as "none" at this time, though the attack is rated as automatable. The vulnerability was discovered and responsibly disclosed by researcher geo-chen on June 4, 2026, with the report accepted the same day (Red Hat CVE, Researcher Write-up).

1. Identify target: Locate a Ruby application that uses rubyzip (versions < 3.4.0) to extract user-supplied or remotely fetched ZIP archives — common in file upload features, backup processors, or document importers.
2. Craft malicious archive: Create a ZIP file containing an entry with a path-traversal name such as ../upload_backup/owned.sh. The entry name must share a prefix with the destination directory (e.g., if extraction target is /app/upload, name the entry ../upload_backup/payload.rb).
3. Submit the archive: Upload or otherwise deliver the crafted ZIP to the target application through any interface that triggers Zip::Entry#extract or Zip::File#extract with a controlled destination directory.
4. Trigger extraction: The application calls entry.extract(destination_directory: '/app/upload'). The vulnerable prefix check extract_path.start_with?('/app/upload') passes for /app/upload_backup/payload.rb, and the file is written to the sibling directory.
5. Achieve code execution (if applicable): If the written file is an executable script, configuration file, or application code loaded at runtime (e.g., a Ruby initializer or a cron script), the attacker can achieve remote code execution upon the next invocation (Researcher Write-up, Patch Commit).

• File System: Unexpected files appearing in directories that are siblings of the configured extraction destination (e.g., /app/upload_backup/ when extraction target is /app/upload/); newly created or modified shell scripts, Ruby files, or configuration files in application directories not normally written to during extraction.
• Logs: Application logs showing WARNING: skipped extracting messages (if patched) or absence of such warnings alongside unexpected file creation events; web server access logs showing ZIP file uploads followed by unusual application behavior.
• Process: Unexpected process execution originating from files in sibling directories of the extraction target; cron jobs or background workers executing newly written scripts.
• Network: Outbound connections from the application server to unknown external hosts shortly after a ZIP file upload event, potentially indicating a reverse shell or data exfiltration payload was executed (Researcher Write-up).

Upgrade rubyzip to version 3.4.0 or later, which contains the fix in commit 17edfbf that appends ::File::SEPARATOR to the destination directory in the path prefix check (rubyzip v3.4.0 Release). As a defense-in-depth measure, validate and sanitize all archive entry names before extraction, invoke name_safe? on entries prior to calling extract, and restrict file system write permissions so the application process cannot write to directories outside the intended extraction target. Consider implementing an allowlist of permitted extraction directories and monitoring for unexpected file creation events in sensitive paths (GitHub Advisory).

The vulnerability was assigned by VulnCheck and tracked by Red Hat, ENISA (EUVD-2026-70673), and the GitHub Advisory Database (GHSA-47m2-wp7j-p9vc). The rubyzip maintainer accepted the responsible disclosure report on the same day it was submitted (June 4, 2026). Community reaction has been limited, with automated CVE tracking services (cvefeed.io, vuldb.com, cve.report) picking up the disclosure shortly after publication (Red Hat CVE, GitHub Advisory).