CVE-2021-28966
Tempfile on Windows path traversal vulnerability
In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.
- Record
CVE-2021-28966- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.
- Record
CVE-2021-28966- Updated
- 2026-11-02
EUVDEUVD-2021-0931 No score
In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.
- Record
EUVD-2021-0931- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-46f2-3v63-3xrp
Tempfile on Windows path traversal vulnerability
There is an unintentional directory creation vulnerability in tmpdir library bundled with Ruby on Windows. And there is also an unintentional file creation vulnerability in tempfile library bundled with Ruby on Windows, because it uses tmpdir internally.
- Record
GHSA-46f2-3v63-3xrp- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-28966
In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.
- Record
ALPINE-CVE-2021-28966- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVBELL-CVE-2021-28966
CVE-2021-28966 does not affect BellSoft software
- Record
BELL-CVE-2021-28966- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSV
In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.
- Record
CVE-2021-28966- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-46f2-3v63-3xrp
Tempfile on Windows path traversal vulnerability
There is an unintentional directory creation vulnerability in tmpdir library bundled with Ruby on Windows. And there is also an unintentional file creation vulnerability in tempfile library bundled with Ruby on Windows, because it uses tmpdir internally.
- Record
GHSA-46f2-3v63-3xrp- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVJLSEC-2026-1283
In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.
- Record
JLSEC-2026-1283- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
OSVBIT-ruby-2021-28966 No score
In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.
- Record
BIT-ruby-2021-28966- Updated
- 2026-11-02
OSVBIT-ruby-min-2021-28966 No score
In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.
- Record
BIT-ruby-min-2021-28966- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tmpdirRubyGems |
before 0.1.2 | 0.1.2 |
rubyAlpine:v3.10 |
3.0.0 up to 2.5.9-r0 | 2.5.9-r0 |
rubyAlpine:v3.11 |
3.0.0 up to 2.6.7-r0 | 2.6.7-r0 |
rubyAlpine:v3.12 |
3.0.0 up to 2.7.3-r0 | 2.7.3-r0 |
rubyAlpine:v3.13 |
3.0.0 up to 2.7.3-r0 | 2.7.3-r0 |
rubyAlpine:v3.14 |
3.0.0 up to 2.7.3-r0 | 2.7.3-r0 |
rubyAlpine:v3.15 |
3.0.0 up to 2.7.3-r0 | 2.7.3-r0 |
rubyAlpine:v3.16 |
3.0.0 up to 2.7.3-r0 | 2.7.3-r0 |
rubyAlpine:v3.17 |
3.0.0 up to 2.7.3-r0 | 2.7.3-r0 |
rubyAlpine:v3.18 |
3.0.0 up to 2.7.3-r0 | 2.7.3-r0 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rubyAlpine:v3.19 |
3.0.0 up to 2.7.3-r0 | 2.7.3-r0 |
rubyAlpine:v3.20 |
3.0.0 up to 2.7.3-r0 | 2.7.3-r0 |
rubyAlpine:v3.21 |
3.0.0 up to 2.7.3-r0 | 2.7.3-r0 |
rubyAlpine:v3.22 |
3.0.0 up to 2.7.3-r0 | 2.7.3-r0 |
rubyAlpine:v3.23 |
3.0.0 up to 2.7.3-r0 | 2.7.3-r0 |
rubyAlpine:v3.24 |
3.0.0 up to 2.7.3-r0 | 2.7.3-r0 |
rubyBitnami |
before 2.7.3, 3.0.0 up to 3.0.1 | 2.7.33.0.1 |
ruby-minBitnami |
before 2.7.3, 3.0.0 up to 3.0.1 | 2.7.33.0.1 |
tmpdirRubyGems |
before 0.1.2, plus listed versions 0.1.00.1.1 |
0.1.2 |
ruby_jllJulia |
All versions | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-28966 is a high vulnerability (CVSS 7.5) in Ruby-lang Ruby, published May 6, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 58.0%, the 99th percentile. Fixed in tmpdir 0.1.2.