CVE-2026-85396 is a high severity path traversal in the rubyzip gem before 3.4.0. The extraction check compared path prefixes without a trailing separator, so a crafted entry could write files into a sibling folder outside the target. Upgrade to rubyzip 3.4.0 or later.
What's affected
- Product: rubyzip (Ruby gem),
Zip::Entry#extract. - Affected: versions before 3.4.0 (VulnCheck lists all versions from 0 up to 3.4.0).
- Fixed: 3.4.0. The GitHub release for 3.4.0 notes breaking changes in the 3.x series, so read the upgrade guide.
- Open question: neither source says whether a fix is planned for the 2.4.x line. If you are on 2.x, check the project before assuming.
Severity in the record: High, CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). VulnCheck scores it 8.7 under CVSS v4, against 7.5 under v3.1 in the record.
Weakness class: CWE-22 (Path Traversal).
How to check if you're exposed
rubyzip is often a transitive dependency, so check the resolved version, not just your Gemfile.
bundle info rubyzip
bundle exec gem list rubyzip
grep -n rubyzip Gemfile.lock
bundle exec gem dependency rubyzip --reverse-dependencies
If the version printed is lower than 3.4.0, you are affected. The last command shows which gems pull it in, which helps when you do not depend on it directly. Also search your code for places that call extract on archives from users, partners or downloads, because those are the callers that matter.
What to do now
- Run
bundle update rubyzip, or raise the version constraint in your Gemfile, so the lock file resolves to 3.4.0 or later. - Read the 3.x upgrade notes, because the project warns of breaking changes between 2.4.x and 3.x.
- If a gem you depend on pins an older rubyzip, ask its maintainers for an update, or check whether it can move to the new line.
- Extract untrusted archives into an empty temporary folder with no sibling folders that matter, and run the extraction as a low privilege user.
- Review code that extracts archives and add a check that every resolved path stays inside the destination.
Why it matters
The bug is a string prefix check. If the destination is /srv/app/upload and a crafted name resolves to /srv/app/upload_backup/file, the second path starts with the first, so a naive check says it is inside. A correct check adds a trailing separator or compares resolved path components. The advisory describes entries that write into sibling directories sharing the destination prefix. This is CWE-22.
Unpacking archives is a common place for this class of flaw because the entry names come from the sender. The effect depends on what lives in the sibling folders: scripts, configuration or uploads. The record does not mark this CVE as exploited in the wild.
Try it yourself
Run the inventory demo to see how resolved gems, including transitive ones, appear in a dependency list.
Click through it at your own pace, or open it full screen.
Quick check
Does bundle update rubyzip always work?
Only if no other gem pins an older version. If the update does not move, run the reverse dependency command above to see which gem holds it back.
Sources
Last reviewed: 18 October 2026.
