{"id":"CVE-2017-5946","aliases":["DEBIAN-CVE-2017-5946","DLA-846-1","DSA-3801-1","EUVD-2017-0236","GHSA-gcqq-w6gr-h9j9","MGASA-2017-0264","UBUNTU-CVE-2017-5946","openSUSE-SU-2024:11352-1","openSUSE-SU-2024:13168-1","openSUSE-SU-2024:14176-1","openSUSE-SU-2025:15126-1","openSUSE-SU-2026:10363-1"],"status":"published","title":"Directory traversal vulnerability in RubyZip","description":"The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses \"../\" pathname substrings to write arbitrary files to the filesystem.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03441,"percentile":0.8907,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2017-02-27T07:25:00Z","modified":"2026-10-20T10:49:30Z","fixes":[{"ecosystem":"RubyGems","package":"rubyzip","fixed_in":["1.2.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ruby-zip","fixed_in":["1.2.0-1.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-zip","fixed_in":["1.2.0-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-zip","fixed_in":["1.2.0-1.1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"libzip-ruby","fixed_in":["0.9.4-1+deb7u1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"ruby-zip","fixed_in":["1.1.6-1+deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"ruby-rubyzip","fixed_in":["1.1.4-3.1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"ruby-rubyzip","fixed_in":["1.1.7-1.1.mga6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"rubyzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1.1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"libzip-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-1+deb7u1"}]}],"versions":["0.9.4-1"]},{"source":"osv","ecosystem":"Debian:8","package":"ruby-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.6-1+deb8u1"}]}],"versions":["1.1.6-1"]},{"source":"osv","ecosystem":"RubyGems","package":"rubyzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1"}]}],"versions":["0.5.11","0.5.12","0.5.7","0.5.8","0.5.9","0.9.1","0.9.4","0.9.5","0.9.6.1","0.9.7","0.9.8","0.9.9","1.0.0","1.0.0.beta1","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.2.0"]},{"source":"osv","ecosystem":"Mageia:5","package":"ruby-rubyzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.4-3.1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"ruby-rubyzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.7-1.1.mga6"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ruby-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.7-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-rubyzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-1.11"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rubyzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-1.15"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rubyzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-1.17"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rubyzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-1.19"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"rubyzip_project","product":"rubyzip"}],"references":[{"url":"https://github.com/rubyzip/rubyzip/releases","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"http://www.securityfocus.com/bid/96445","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/rubyzip/rubyzip/issues/315","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.debian.org/security/2017/dsa-3801","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5946","tags":["advisory"]},{"url":"https://web.archive.org/web/20200227185727/http://www.securityfocus.com/bid/96445","tags":["web"]},{"url":"https://github.com/rubyzip/rubyzip/commit/ce4208fdecc2ad079b05d3c49d70fe6ed1d07016","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubyzip/CVE-2017-5946.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gcqq-w6gr-h9j9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-5946","tags":["advisory"]},{"url":"https://github.com/rubyzip/rubyzip","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2017-0264.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21493","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2017-08/msg00025.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-5946","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5946","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000544","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-5946","description":"The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses \"../\" pathname substrings to write arbitrary files to the filesystem.","status":"published","published":"2017-02-27T07:25:00Z","modified":"2024-08-05T15:18:49.419Z","updated_at":"2026-11-02T14:33:12.599234Z"}],"euvd":[{"id":"EUVD-2017-0236","description":"The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses \"../\" pathname substrings to write arbitrary files to the filesystem.","status":"published","published":"2017-02-27T07:25:00Z","modified":"2024-08-05T15:18:49Z","updated_at":"2026-11-03T02:39:13.436112Z"}],"ghsa":[{"id":"GHSA-gcqq-w6gr-h9j9","title":"Directory traversal vulnerability in RubyZip","description":"The `Zip::File` component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses `../` pathname substrings to write arbitrary files to the filesystem.","status":"published","published":"2017-10-24T18:33:35Z","modified":"2023-08-28T10:41:11Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:37:00.680009Z"}],"nvd":[{"id":"CVE-2017-5946","description":"The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses \"../\" pathname substrings to write arbitrary files to the filesystem.","status":"published","published":"2017-02-27T07:59:00.317Z","modified":"2026-06-17T01:21:29.36Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:03:43.325192Z"}],"osv":[{"id":"CVE-2017-5946","description":"The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses \"../\" pathname substrings to write arbitrary files to the filesystem.","status":"published","published":"2017-02-27T07:59:00.317Z","modified":"2026-10-20T10:49:30.364819214Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:06.029968Z"},{"id":"DEBIAN-CVE-2017-5946","description":"The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses \"../\" pathname substrings to write arbitrary files to the filesystem.","status":"published","published":"2017-02-27T07:59:00.317Z","modified":"2026-09-01T20:03:48.784918029Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:29.412243Z"},{"id":"GHSA-gcqq-w6gr-h9j9","title":"Directory traversal vulnerability in RubyZip","description":"The `Zip::File` component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses `../` pathname substrings to write arbitrary files to the filesystem.","status":"published","published":"2017-10-24T18:33:35Z","modified":"2024-02-16T08:12:37.749196Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:47.822182Z"},{"id":"UBUNTU-CVE-2017-5946","description":"The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses \"../\" pathname substrings to write arbitrary files to the filesystem.","status":"published","published":"2017-02-27T07:59:00Z","modified":"2025-10-24T04:46:10Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:15.388065Z"},{"id":"DLA-846-1","title":"libzip-ruby - security update","status":"published","published":"2017-03-06T00:00:00Z","modified":"2026-03-09T02:08:46.237691Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3801-1","title":"ruby-zip - security update","status":"published","published":"2017-03-04T00:00:00Z","modified":"2026-03-09T01:18:27.590558Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0264","title":"Updated ruby-rubyzip packages fix security vulnerability","description":"A directory traversal vulnerability could lead to access and overwrite\nfiles that are outside of the restricted directory (CVE-2017-5946).\n","status":"published","published":"2017-08-13T13:17:41Z","modified":"2026-06-04T05:30:04.159785681Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:11352-1","title":"ruby2.7-rubygem-rubyzip-2.3.2-1.2 on GA media","description":"These are all security issues fixed in the ruby2.7-rubygem-rubyzip-2.3.2-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:14:09.379088Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:13168-1","title":"ruby3.2-rubygem-rubyzip-2.3.2-1.11 on GA media","description":"These are all security issues fixed in the ruby3.2-rubygem-rubyzip-2.3.2-1.11 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:26:33.987041Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:14176-1","title":"ruby3.3-rubygem-rubyzip-2.3.2-1.15 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-rubyzip-2.3.2-1.15 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-12T00:00:00Z","modified":"2026-02-04T03:55:32.985836Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2025:15126-1","title":"ruby3.4-rubygem-rubyzip-2.3.2-1.17 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-rubyzip-2.3.2-1.17 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-17T00:00:00Z","modified":"2026-02-04T03:14:31.897425Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2026:10363-1","title":"ruby4.0-rubygem-rubyzip-2.3.2-1.19 on GA media","description":"These are all security issues fixed in the ruby4.0-rubygem-rubyzip-2.3.2-1.19 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-13T00:00:00Z","modified":"2026-03-14T08:26:09.295615Z","updated_at":"2026-11-02T16:58:38.415593Z"}]}}