CVE-2007-0469

RubyGems file overwrite vulnerability

9.3 HighFix available

The extract_files function in installer.rb in RubyGems before 0.9.1 does not check whether files exist before overwriting them, which allows user-assisted remote attackers to overwrite arbitrary files, cause a denial of service, or execute arbitrary code via crafted GEM packages.

Exploit likelihood

4.86%Down 0.1 points since Feb 4, 2022

What each source reports

NVD Score used 9.3

Record: CVE-2007-0469
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Updated: 2026-11-02

CVE List No score

Record: CVE-2007-0469
Updated: 2026-11-02

EUVDEUVD-2022-3295 No score

Record: EUVD-2022-3295
Updated: 2026-11-03

GitHub AdvisoriesGHSA-95vx-q4c2-64gr No score

RubyGems file overwrite vulnerability

The extract_files function in installer.rb in RubyGems before 0.9.1 does not check whether files exist before overwriting them, which allows user-assisted remote attackers to overwrite arbitrary files, cause a denial of service, or execute arbitrary code via crafted GEM packages.

Record: GHSA-95vx-q4c2-64gr
Updated: 2026-11-02

OSVGHSA-95vx-q4c2-64gr No score

RubyGems file overwrite vulnerability

Record: GHSA-95vx-q4c2-64gr
Updated: 2026-11-02

Affected products

rubyforge rubygems

Affected packages

Affected packages
Package	Affected	Fixed
`rubygems-update` RubyGems	before 0.9.1	0.9.1
`rubygems-update` RubyGems	before 0.9.1, plus listed versions 0.8.100.8.110.8.30.8.40.8.50.8.60.8.80.9.0	0.9.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2007-0469 is a high vulnerability (CVSS 9.3) in Rubyforge Rubygems, published January 24, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.86%, the 92nd percentile. Fixed in rubygems-update 0.9.1.

References

Show 5 moreShow less