{"id":"CVE-2021-28966","aliases":["ALPINE-CVE-2021-28966","BELL-CVE-2021-28966","BIT-ruby-2021-28966","BIT-ruby-min-2021-28966","EUVD-2021-0931","GHSA-46f2-3v63-3xrp","JLSEC-2026-1283"],"status":"published","title":"Tempfile on Windows path traversal vulnerability","description":"In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.58039,"percentile":0.991,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2021-05-06T15:01:36Z","modified":"2026-10-24T10:30:18Z","fixes":[{"ecosystem":"RubyGems","package":"tmpdir","fixed_in":["0.1.2"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.10","package":"ruby","fixed_in":["2.5.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"ruby","fixed_in":["2.6.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"ruby","fixed_in":["2.7.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"ruby","fixed_in":["2.7.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"ruby","fixed_in":["2.7.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"ruby","fixed_in":["2.7.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"ruby","fixed_in":["2.7.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"ruby","fixed_in":["2.7.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"ruby","fixed_in":["2.7.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"ruby","fixed_in":["2.7.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"ruby","fixed_in":["2.7.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"ruby","fixed_in":["2.7.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"ruby","fixed_in":["2.7.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"ruby","fixed_in":["2.7.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"ruby","fixed_in":["2.7.3-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"ruby","fixed_in":["2.7.3","3.0.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"ruby-min","fixed_in":["2.7.3","3.0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"tmpdir","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.10","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"2.5.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"2.6.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"2.7.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"2.7.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"2.7.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"2.7.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"2.7.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"2.7.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"2.7.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"2.7.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"2.7.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"2.7.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"2.7.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"2.7.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"2.7.3-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"ruby","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.7.3"},{"introduced":"3.0.0"},{"fixed":"3.0.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"ruby-min","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.7.3"},{"introduced":"3.0.0"},{"fixed":"3.0.1"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"tmpdir","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2"}]}],"versions":["0.1.0","0.1.1"]},{"source":"osv","ecosystem":"Julia","package":"ruby_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}],"products":[{"vendor":"ruby-lang","product":"ruby"}],"references":[{"url":"https://hackerone.com/reports/1131465","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://security.netapp.com/advisory/ntap-20210902-0004/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28966","tags":["web","advisory"]},{"url":"https://github.com/ruby/tmpdir/pull/8","tags":["web"]},{"url":"https://github.com/ruby/tmpdir/commit/93798c01cb7c10476e50a4d80130a329ba47f348","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/tmpdir/CVE-2021-28966.yml","tags":["web"]},{"url":"https://rubygems.org/gems/tmpdir","tags":["web"]},{"url":"https://www.ruby-lang.org/en/news/2021/04/05/tempfile-path-traversal-on-windows-cve-2021-28966/"},{"url":"https://github.com/advisories/GHSA-46f2-3v63-3xrp"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-28966","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-28966","tags":["advisory"]},{"url":"https://github.com/ruby/tmpdir","tags":["package"]},{"url":"https://security.netapp.com/advisory/ntap-20210902-0004","tags":["web"]},{"url":"https://www.ruby-lang.org/en/news/2021/04/05/tempfile-path-traversal-on-windows-cve-2021-28966","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-28966","description":"In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.","status":"published","published":"2021-07-27T16:01:12Z","modified":"2024-08-03T21:55:12.239Z","updated_at":"2026-11-02T14:33:08.811269Z"}],"euvd":[{"id":"EUVD-2021-0931","description":"In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.","status":"published","published":"2021-07-27T16:01:12Z","modified":"2024-08-03T21:55:12Z","updated_at":"2026-11-03T03:24:46.117926Z"}],"ghsa":[{"id":"GHSA-46f2-3v63-3xrp","title":"Tempfile on Windows path traversal vulnerability","description":"There is an unintentional directory creation vulnerability in `tmpdir` library bundled with Ruby on Windows. And there is also an unintentional file creation vulnerability in tempfile library bundled with Ruby on Windows, because it uses tmpdir internally. \n","status":"published","published":"2021-05-06T15:01:36Z","modified":"2023-01-27T05:00:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:36:15.574072Z"}],"nvd":[{"id":"CVE-2021-28966","description":"In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.","status":"published","published":"2021-07-30T14:15:16.303Z","modified":"2026-06-17T03:47:06.01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:06:56.185362Z"}],"osv":[{"id":"ALPINE-CVE-2021-28966","description":"In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.","status":"published","published":"2021-07-30T14:15:16.303Z","modified":"2026-10-23T17:17:56.179702631Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"BELL-CVE-2021-28966","title":"CVE-2021-28966 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:22.557526Z","modified":"2026-01-26T09:46:54.779595Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2021-28966","description":"In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.","status":"published","published":"2021-07-30T14:15:16.303Z","modified":"2026-10-24T10:30:18.110234372Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"GHSA-46f2-3v63-3xrp","title":"Tempfile on Windows path traversal vulnerability","description":"There is an unintentional directory creation vulnerability in `tmpdir` library bundled with Ruby on Windows. And there is also an unintentional file creation vulnerability in tempfile library bundled with Ruby on Windows, because it uses tmpdir internally. \n","status":"published","published":"2021-05-06T15:01:36Z","modified":"2025-01-27T08:58:38.818172Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:36.434231Z"},{"id":"JLSEC-2026-1283","description":"In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.","status":"published","published":"2026-08-13T09:49:53.975Z","modified":"2026-08-13T10:00:11.403962589Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"BIT-ruby-2021-28966","description":"In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.","status":"published","published":"2024-03-06T11:05:31.087Z","modified":"2026-09-08T08:48:19.333098831Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"BIT-ruby-min-2021-28966","description":"In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.","status":"published","published":"2025-01-27T07:20:58.528Z","modified":"2026-09-08T08:48:19.230159073Z","updated_at":"2026-11-02T15:28:35.111822Z"}]}}