CVE-2026-82455: RubyGems Path Traversal Vulnerability

CVE-2026-82455 Overview

CVE-2026-82455 is a path traversal vulnerability in RubyGems caused by insufficient validation after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, files that appear to be written under the destination directory can instead be written outside of it. This breaks the extraction safety boundary and allows an attacker-controlled gem to place files at arbitrary locations on the local filesystem. The flaw is tracked under CWE-59: Link Following and affects RubyGems versions before 4.0.13.

Critical Impact
A malicious gem can write files outside the intended extraction directory by exploiting a pre-existing symlink, enabling integrity and availability compromise on local systems that install untrusted gems.

Affected Products

RubyGems versions before 4.0.13
Ruby applications and CI pipelines that install untrusted gems using vulnerable RubyGems releases
Developer workstations and build hosts that unpack gem archives with gem install or gem unpack

Discovery Timeline

2026-08-29 - CVE-2026-82455 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82455

Vulnerability Analysis

RubyGems extracts gem archives into a destination directory using logic in lib/rubygems/package.rb. The extractor checks that each entry's declared path resolves under the destination directory before creating parent directories. However, it does not re-validate path containment after the operating system resolves symbolic links on disk. If a symlink already exists inside the destination directory and points outside the extraction root, subsequent writes follow that symlink and land outside the intended boundary.

The issue is a classic time-of-check to time-of-use pattern combined with unsafe link following. The logical path passes validation, but the physical path on disk escapes the sandbox. An attacker who can plant or influence a symlink in the destination directory, or who controls a gem that creates such a symlink earlier in the same extraction, can write arbitrary files during installation.

Root Cause

The root cause is missing real-path resolution of the parent directory before writing extracted content. RubyGems validated the joined logical path but did not call File.realpath on the resolved parent directory to confirm it still resides within the destination. Without this check, symlinks encountered during traversal are followed without enforcement.

Attack Vector

Exploitation is local and requires user interaction, typically a developer or automation account running gem install on a crafted gem. The attacker delivers a gem archive that either relies on a pre-existing symlink in the extraction target or crafts the archive so that an early entry creates a symlink pointing outside the destination. Later entries write through that symlink, dropping files into paths chosen by the attacker.

The fix in pull request #9493 resolves the real path of the parent directory and raises Gem::Package::PathError if it escapes the destination directory.

ruby

           directories << mkdir
         end
 
+        real_mkdir = File.realpath(mkdir)
+        unless real_mkdir == destination_dir || normalize_path(real_mkdir).start_with?(normalize_path(destination_dir + "/"))
+          raise Gem::Package::PathError.new(real_mkdir, destination_dir)
+        end
+
         if entry.file?
           File.open(destination, "wb") do |out|
             copy_stream(tar.io, out, entry.size)

Source: GitHub commit 103ca423

Detection Methods for CVE-2026-82455

Indicators of Compromise

Files created outside the expected gem installation directory (for example, outside GEM_HOME or the Bundler vendor path) shortly after a gem install or bundle install run.
Presence of symbolic links inside gem extraction targets that resolve to paths such as /etc, /home, or user startup files.
Unexpected modifications to shell configuration files, cron directories, or CI runner scripts following gem installation from untrusted sources.

Detection Strategies

Audit gem contents before installation by unpacking archives in a sandbox and enumerating symlink entries with tar -tvf against the underlying data.tar.gz.
Monitor process telemetry for ruby or gem processes writing to paths outside GEM_HOME, ~/.gem, or project vendor/bundle directories.
Correlate file creation events with parent process lineage to identify writes performed through symlinks during package extraction.

Monitoring Recommendations

Enable filesystem auditing on developer workstations and CI runners for writes performed by Ruby interpreters outside expected gem directories.
Track installation of gems from untrusted sources and record the RubyGems version in use across build agents.
Alert on creation of symlinks by gem processes that target paths outside the current extraction root.

How to Mitigate CVE-2026-82455

Immediate Actions Required

Upgrade RubyGems to version 4.0.13 or later on all developer workstations, servers, and CI build agents.
Restrict gem install operations to trusted sources and enforce checksum verification through Gemfile.lock and bundle install --frozen.
Review recent installations of third-party gems and inspect extraction directories for symlinks that escape the destination.

Patch Information

The fix is merged in RubyGems via pull request #9493 and commit 103ca4230deacb31b9fcd813de109e83b5fc71ac. The patched code resolves the real path of the parent directory before writing and raises Gem::Package::PathError when the resolved path escapes destination_dir. See the VulnCheck advisory for additional context.

Workarounds

Install gems only inside disposable containers or ephemeral CI jobs where filesystem writes outside the workspace cause no persistent damage.
Run gem install under a low-privilege account that lacks write access to sensitive paths such as /etc, /usr/local, and user startup files.
Pre-scan gem archives for symlink entries and reject any gem whose entries resolve outside the extraction root.

bash

# Upgrade RubyGems to the patched release
gem update --system 4.0.13
gem --version