CVE-2021-28966 Tempfile on Windows path traversal vulnerability
A remote attacker can exploit a path traversal vulnerability in Ruby's TmpDir handling on Windows to read or modify arbitrary files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-28966?
CVE-2021-28966 is a high-severity path traversal vulnerability in Ruby-Lang Ruby, published on 27 Jul 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.
Weakness: CWE-22
Which versions are affected by CVE-2021-28966?
4 open source packages ship an affected version, including ruby, ruby-min and tmpdir. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ruby Bitnami | All versions | 2.7.3, 3.0.1 |
ruby-min Bitnami | All versions | 2.7.3, 3.0.1 |
tmpdir RubyGems | All versions | 0.1.2 |
tmpdir RubyGems | All versions | 0.1.2 |
Products include Ruby-Lang Ruby.
How do I fix CVE-2021-28966?
Upgrade ruby to a fixed version for your release line: 2.7.3 or 3.0.1.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-28966 being exploited?
There is no known exploitation of CVE-2021-28966 in the wild and no public exploit code.
Other vulnerabilities in Ruby-Lang Ruby
Sources
Also known as ALPINE-CVE-2021-28966, BIT-ruby-2021-28966, BIT-ruby-min-2021-28966, CLEANSTART-2026-YW10276, GHSA-46f2-3v63-3xrp, JLSEC-2026-1283.