Back

CVE-2017-5946

CRITICAL

The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses "../" pathname substrings to write arbitrary files to the filesystem.

Published: Feb 27, 2017 Modified: Jun 17, 2026
CWE-22

CVSS Metrics

CVSSv3
Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (3)

Vendor Product Version
rubyzip_project rubyzip * < 1.2.1
debian debian_linux 8.0
debian debian_linux 9.0

GitHub Security Advisory GHSA-gcqq-w6gr-h9j9

Directory traversal vulnerability in RubyZip

rubygems rubyzip < 1.2.1 Fixed: 1.2.1

Risk Scores

CVSS Score 9.8 / 10
EPSS Score 3.47%

Top 12% most likely to be exploited

Threat Score 40.2 / 100

Data Sources

NVD EPSS GitHub