CVE-2017-5946
CriticalSummary
The Zip::File component in the rubyzip gem before version 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses "../" pathname substrings to write arbitrary files to the filesystem.
Risk Assessment
The risk involves the possibility of overwriting or creating arbitrary files on the server, which could lead to application or system compromise.
Recommendation
Update the rubyzip gem to version 1.2.1 or later and verify that the application processes zip archives with proper path validation.
Original NVD description (English source)
The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses "../" pathname substrings to write arbitrary files to the filesystem.