CVE-2017-5946
Directory traversal vulnerability in RubyZip
CVE-2017-5946 is a critical vulnerability (CVSS 9.8) in Rubyzip Project Rubyzip, published February 27, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.44%, the 88th percentile. Fixed in rubyzip 1.2.1.
The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses "../" pathname substrings to write arbitrary files to the filesystem.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses "../" pathname substrings to write arbitrary files to the filesystem.
- Record
CVE-2017-5946- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses "../" pathname substrings to write arbitrary files to the filesystem.
- Record
CVE-2017-5946- Updated
- 2026-11-02
EUVDEUVD-2017-0236 No score
The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses "../" pathname substrings to write arbitrary files to the filesystem.
- Record
EUVD-2017-0236- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gcqq-w6gr-h9j9
Directory traversal vulnerability in RubyZip
The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses ../ pathname substrings to write arbitrary files to the filesystem.
- Record
GHSA-gcqq-w6gr-h9j9- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses "../" pathname substrings to write arbitrary files to the filesystem.
- Record
CVE-2017-5946- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-5946
The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses "../" pathname substrings to write arbitrary files to the filesystem.
- Record
DEBIAN-CVE-2017-5946- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVGHSA-gcqq-w6gr-h9j9
Directory traversal vulnerability in RubyZip
The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses ../ pathname substrings to write arbitrary files to the filesystem.
- Record
GHSA-gcqq-w6gr-h9j9- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-5946
The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses "../" pathname substrings to write arbitrary files to the filesystem.
- Record
UBUNTU-CVE-2017-5946- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0264 No score
Updated ruby-rubyzip packages fix security vulnerability
A directory traversal vulnerability could lead to access and overwrite files that are outside of the restricted directory (CVE-2017-5946).
- Record
MGASA-2017-0264- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11352-1 No score
ruby2.7-rubygem-rubyzip-2.3.2-1.2 on GA media
These are all security issues fixed in the ruby2.7-rubygem-rubyzip-2.3.2-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11352-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13168-1 No score
ruby3.2-rubygem-rubyzip-2.3.2-1.11 on GA media
These are all security issues fixed in the ruby3.2-rubygem-rubyzip-2.3.2-1.11 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13168-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14176-1 No score
ruby3.3-rubygem-rubyzip-2.3.2-1.15 on GA media
These are all security issues fixed in the ruby3.3-rubygem-rubyzip-2.3.2-1.15 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14176-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15126-1 No score
ruby3.4-rubygem-rubyzip-2.3.2-1.17 on GA media
These are all security issues fixed in the ruby3.4-rubygem-rubyzip-2.3.2-1.17 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15126-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10363-1 No score
ruby4.0-rubygem-rubyzip-2.3.2-1.19 on GA media
These are all security issues fixed in the ruby4.0-rubygem-rubyzip-2.3.2-1.19 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10363-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rubyzipRubyGems |
before 1.2.1 | 1.2.1 |
ruby-zipDebian:12 |
before 1.2.0-1.1 | 1.2.0-1.1 |
ruby-zipDebian:13 |
before 1.2.0-1.1 | 1.2.0-1.1 |
ruby-zipDebian:14 |
before 1.2.0-1.1 | 1.2.0-1.1 |
libzip-rubyDebian:7 |
before 0.9.4-1+deb7u1, plus listed versions 0.9.4-1 |
0.9.4-1+deb7u1 |
ruby-zipDebian:8 |
before 1.1.6-1+deb8u1, plus listed versions 1.1.6-1 |
1.1.6-1+deb8u1 |
rubyzipRubyGems |
before 1.2.1, plus listed versions 0.5.110.5.120.5.70.5.80.5.9 Show 18 moreShow less0.9.10.9.40.9.50.9.6.10.9.70.9.80.9.91.0.01.0.0.beta11.1.01.1.11.1.21.1.31.1.41.1.51.1.61.1.71.2.0 |
1.2.1 |
ruby-rubyzipMageia:5 |
before 1.1.4-3.1.mga5 | 1.1.4-3.1.mga5 |
ruby-rubyzipMageia:6 |
before 1.1.7-1.1.mga6 | 1.1.7-1.1.mga6 |
ruby-zipUbuntu:16.04:LTS |
All versions, plus listed versions 1.1.7-1 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ruby3.2-rubygem-rubyzipopenSUSE:Tumbleweed |
before 2.3.2-1.11 | 2.3.2-1.11 |
rubygem-rubyzipopenSUSE:Tumbleweed |
before 2.3.2-1.15 | 2.3.2-1.15 |
rubygem-rubyzipopenSUSE:Tumbleweed |
before 2.3.2-1.17 | 2.3.2-1.17 |
rubygem-rubyzipopenSUSE:Tumbleweed |
before 2.3.2-1.19 | 2.3.2-1.19 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
github.com/rubyzip/rubyzip/releases
securityfocus.com/bid/96445
debian.org/security/2017/dsa-3801
nvd.nist.gov/vuln/detail/CVE-2017-5946
web.archive.org/web/20200227185727/http://www.securityfocus.com/bid/96445
Show 12 moreShow less
security-tracker.debian.org/tracker/CVE-2017-5946
advisories.mageia.org/MGASA-2017-0264.html
bugs.mageia.org/show_bug.cgi?id=21493
lists.opensuse.org/opensuse-updates/2017-08/msg00025.html
ubuntu.com/security/CVE-2017-5946
cve.org/CVERecord?id=CVE-2017-5946
suse.com/security/cve/CVE-2017-5946