Directory traversal vulnerability in RubyZip (GHSA-gcqq-w6gr-h9j9)
Published: 2017-10-24T18:33:35Z
Aliases: CVE-2017-5946
Severity: CRITICAL · CWE: CWE-22

The `Zip::File` component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses `../` pathname substrings to write arbitrary files to the filesystem.

Affected packages:
package: ecosystem: RubyGems
name: rubyzip
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.2.1