Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Ruby on Windows TmpDir Parameter Path Traversal Vulnerability

CVE-2021-28966 · published 5 years ago
Summary

Ruby on Windows can be tricked into writing files to arbitrary locations. This could allow an attacker to put malicious files on the system. To fix this, update Ruby to a version newer than 3.0.

What to do
  • Update yukihiro matsumoto tmpdir to version 0.1.2.
Affected software
Ecosystem VendorProductAffected versions
rubygems yukihiro matsumoto tmpdir < 0.1.2
Fix: upgrade to 0.1.2
– ruby-lang ruby < 2.7.3
>= 3.0.0, < 3.0.1
cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
Original advisory text
In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.
In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
58% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published30 Jul 2021
Updated7 Oct 2026
First seen6 Mar 2026
Sources
GHSA-46f2-3v63-3xrp · GHSA
CVE-2021-28966 · NVD
Track software like this
Free during beta