CVE-2011-1004

The FileUtils.remove_entry_secure method in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330...

6.3 MediumFix available

CVE-2011-1004 is a medium vulnerability (CVSS 6.3) in Ruby-lang Ruby, published March 2, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 32nd percentile. Fixed in ruby 0:1.8.5-19.el5_6.1.

The FileUtils.remove_entry_secure method in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, 1.8.8dev, 1.9.1 through 1.9.1-430, 1.9.2 through 1.9.2-136, and 1.9.3dev allows local users to delete arbitrary files via a symlink attack.

Exploit likelihood

0.39%Down 1.2 points since Feb 4, 2022

What each source reports

NVD Score used 6.3

Record: CVE-2011-1004
CVSS 2.0: 6.3 MediumAV:L/AC:M/Au:N/C:N/I:C/A:C
Weakness: CWE-59
Updated: 2026-11-02

CVE List No score

Record: CVE-2011-1004
Updated: 2026-11-02

EUVDEUVD-2011-1021 No score

Record: EUVD-2011-1021
Updated: 2026-11-03

GitHub AdvisoriesGHSA-45wv-gc6w-fq7m No score

The FileUtils.remove_entry_secure method in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330...

Record: GHSA-45wv-gc6w-fq7m
Weakness: CWE-59
Updated: 2026-11-02

Affected products

ruby-lang ruby

Affected packages

Affected packages
Package	Affected	Fixed
`ruby` Red Hat:enterprise_linux:5::server	before 0:1.8.5-19.el5_6.1	0:1.8.5-19.el5_6.1
`ruby-debuginfo` Red Hat:enterprise_linux:5::server	before 0:1.8.5-19.el5_6.1	0:1.8.5-19.el5_6.1
`ruby-devel` Red Hat:enterprise_linux:5::server	before 0:1.8.5-19.el5_6.1	0:1.8.5-19.el5_6.1
`ruby-docs` Red Hat:enterprise_linux:5::server	before 0:1.8.5-19.el5_6.1	0:1.8.5-19.el5_6.1
`ruby-irb` Red Hat:enterprise_linux:5::server	before 0:1.8.5-19.el5_6.1	0:1.8.5-19.el5_6.1
`ruby-libs` Red Hat:enterprise_linux:5::server	before 0:1.8.5-19.el5_6.1	0:1.8.5-19.el5_6.1
`ruby-mode` Red Hat:enterprise_linux:5::server	before 0:1.8.5-19.el5_6.1	0:1.8.5-19.el5_6.1
`ruby-rdoc` Red Hat:enterprise_linux:5::server	before 0:1.8.5-19.el5_6.1	0:1.8.5-19.el5_6.1
`ruby-ri` Red Hat:enterprise_linux:5::server	before 0:1.8.5-19.el5_6.1	0:1.8.5-19.el5_6.1
`ruby-tcltk` Red Hat:enterprise_linux:5::server	before 0:1.8.5-19.el5_6.1	0:1.8.5-19.el5_6.1

Show 10 moreShow less

Affected packages
Package	Affected	Fixed
`ruby` Red Hat:enterprise_linux:6::server	before 0:1.8.7.299-7.el6_1.1	0:1.8.7.299-7.el6_1.1
`ruby-debuginfo` Red Hat:enterprise_linux:6::server	before 0:1.8.7.299-7.el6_1.1	0:1.8.7.299-7.el6_1.1
`ruby-irb` Red Hat:enterprise_linux:6::server	before 0:1.8.7.299-7.el6_1.1	0:1.8.7.299-7.el6_1.1
`ruby-libs` Red Hat:enterprise_linux:6::server	before 0:1.8.7.299-7.el6_1.1	0:1.8.7.299-7.el6_1.1
`ruby-devel` Red Hat:enterprise_linux:6::server	before 0:1.8.7.299-7.el6_1.1	0:1.8.7.299-7.el6_1.1
`ruby-docs` Red Hat:enterprise_linux:6::server	before 0:1.8.7.299-7.el6_1.1	0:1.8.7.299-7.el6_1.1
`ruby-rdoc` Red Hat:enterprise_linux:6::server	before 0:1.8.7.299-7.el6_1.1	0:1.8.7.299-7.el6_1.1
`ruby-ri` Red Hat:enterprise_linux:6::server	before 0:1.8.7.299-7.el6_1.1	0:1.8.7.299-7.el6_1.1
`ruby-static` Red Hat:enterprise_linux:6::server	before 0:1.8.7.299-7.el6_1.1	0:1.8.7.299-7.el6_1.1
`ruby-tcltk` Red Hat:enterprise_linux:6::server	before 0:1.8.7.299-7.el6_1.1	0:1.8.7.299-7.el6_1.1

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 38 moreShow less