CVE-2018-6914

Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 might allow attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument.

Affected products

Alt Linux, Centos, Red Hat, Ruby, Suse, Ubuntu

Ruby-lang Ruby

< 2.2.10, 2.3.7, 2.4.4, 2.5.1, 2.6.0

Fix

Available

CVSS 3.0

7.5 HIGH

EPSS

10.6% (95th percentile)

Weakness

CWE-22

NVD status

Modified

Published

2018-04-03

No exploit for CVE-2018-6914 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.