{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-82455", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-29T13:22:59.614Z", "datePublished": "2026-08-29T13:47:56.760Z", "dateUpdated": "2026-08-29T13:47:56.760Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-29T13:47:56.760Z"}, "datePublic": "2026-05-26T00:00:00.000Z", "title": "RubyGems before 4.0.13 Path Traversal via Symlink Resolution", "descriptions": [{"lang": "en", "value": "RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be written outside of it, breaking the extraction safety boundary. The fix resolves the real path of the parent directory before writing and raises Gem::Package::PathError if it escapes the destination directory."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Link Resolution Before File Access ('Link Following')", "cweId": "CWE-59", "type": "CWE"}]}], "affected": [{"vendor": "ruby", "product": "rubygems", "defaultStatus": "unaffected", "versions": [{"version": "3.2.30", "lessThan": "4.0.13", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*", "versionEndExcluding": "4.0.13"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/ruby/rubygems/pull/9493", "tags": ["issue-tracking", "patch"], "name": "Pull Request #9493"}, {"url": "https://github.com/ruby/rubygems/commit/103ca4230deacb31b9fcd813de109e83b5fc71ac", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/ruby/rubygems", "tags": ["product"]}, {"name": "VulnCheck Advisory: RubyGems before 4.0.13 Path Traversal via Symlink Resolution", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/rubygems-before-4.0.13-path-traversal-via-symlink-resolution"}], "credits": [{"lang": "en", "value": "Ali Firas", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "rubygems", "vendor": "ruby", "versions": [{"lessThan": "4.0.13", "status": "affected", "version": "3.2.30", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be written outside of it, breaking the extraction safety boundary. The fix resolves the real path of the parent directory before writing and raises Gem::Package::PathError if it escapes the destination directory."}], "id": "CVE-2026-82455", "lastModified": "2026-08-29T14:16:38.623", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-08-29T14:16:38.623", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/ruby/rubygems"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/ruby/rubygems/commit/103ca4230deacb31b9fcd813de109e83b5fc71ac"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/ruby/rubygems/pull/9493"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/rubygems-before-4.0.13-path-traversal-via-symlink-resolution"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{}

{"created": "2026-08-29T15:30:05.104303+00:00", "updated": "2026-08-29T15:30:05.104309+00:00", "vendors": []}