rubyzip CVE-2026-85396

Exploitation requires that the target application (1) uses rubyzip's Zip::Entry#extract method or any higher-level wrapper that calls it, and (2) processes a ZIP archive supplied or influenced by the attacker. The destination directory used for extraction must have a sibling directory whose name begins with the same string prefix as the destination; since the attacker controls archive entry names, they can craft paths targeting any predictable sibling by naming entries accordingly. No authentication is required at the rubyzip library level; whether unauthenticated users can supply archives depends on the application. Exploitation is limited by: the attacker must be able to deliver a malicious archive to the extraction code path; the write target must be within a directory writable by the application process and actionable (e.g., a web root, cron directory, or SSH authorized_keys location); and the sibling directory must exist or be creatable. Applications that extract archives exclusively from trusted, internal sources are not exposed.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N) scoring 8.7 accurately captures the worst-case scenario: a server that automatically extracts user-supplied archives is exploitable without any authentication or user interaction, with high integrity impact via arbitrary file write. Real-world risk is strongly deployment-dependent - applications that accept archive uploads and extract them automatically into predictable directory structures (common in Rails file-management, backup, and CI/CD tooling) are directly exposed, while deployments that only extract archives from trusted internal sources face negligible risk. No EPSS data was provided in the input and the vulnerability does not appear in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The attack logic is simple and reliable - it requires no memory corruption or timing - so automatable exploitation is plausible against any exposed endpoint, meaning even a moderately sized organization running vulnerable rubyzip versions in a file-processing pipeline should prioritize this patch. The technical impact score is well-supported; no conflicting signals were identified between the CVSS vector and the described mechanism.

An attacker uploads a ZIP archive containing an entry named ../out_evil/backdoor.sh to a web application that automatically extracts user uploads into a destination directory named out (for example, /var/www/app/uploads/out). When the application calls Zip::Entry#extract, the flawed prefix check accepts the resolved path /var/www/app/uploads/out_evil/backdoor.sh because it begins with the string /var/www/app/uploads/out, writing the attacker-controlled file to the sibling directory. If out_evil is a cron script directory or a web-accessible path, the attacker achieves remote code execution. No public exploit code has been identified at time of analysis, but the attack is trivially reproducible from the commit diff and test fixture.