azure linux rubygem-rubyzip vulnerabilities

Latest azure linux rubygem-rubyzip CVEs

Newest publication first

1. CVE-2026-85396 rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix

   Published 2026-09-03

   High·CVSS 8.7

   rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../upload_backup/owned.sh to write...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.