RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be written outside of it, breaking the extraction safety boundary. The fix resolves the real path of the parent directory before writing and raises Gem::Package::PathError if it escapes the destination directory.
This CVE has been withdrawn by MITRE
MITRE marked CVE-2026-82455 as REJECTED on . It is no longer considered a valid vulnerability record. The original content below is preserved for historical reference only.
Reason given by MITRE
The RubyGems maintainers determined that the reported symlink-following behavior during gem extraction is not a security vulnerability, so no vulnerability exists for this record to describe.
CVE-2026-82455
✕ Withdrawn — historical dataHIGHPre-NVD 7.1
7.1CVSS
- CVSS v3
- 7.1
- EchelonGraph score
- Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
- EPSS PROB
- —
- EPSS %ILE
- —
- KEV
- —Not applicable: this CVE ID was withdrawn
Published
August 29, 2026
Last Modified
August 31, 2026
References (4)
- disclosure@vulncheckhttps://github.com/ruby/rubygems
- disclosure@vulncheckhttps://github.com/ruby/rubygems/commit/103ca4230deacb31b9fcd813de109e83b5fc71ac
- disclosure@vulncheckhttps://github.com/ruby/rubygems/pull/9493
- disclosure@vulncheckhttps://www.vulncheck.com/advisories/rubygems-before-4.0.13-path-traversal-via-symlink-resolution
Frequently asked(4)
What is CVE-2026-82455?
CVE-2026-82455 is a rejected CVE ID: its record was withdrawn on September 11, 2026 and no longer describes a vulnerability. Reason given: The RubyGems maintainers determined that the reported symlink-following behavior during gem extraction is not a security vulnerability, so no vulnerability exists for this record to describe.
When was the CVE record for CVE-2026-82455 published?
The CVE record for CVE-2026-82455 was published on August 29, 2026. EchelonGraph's copy of the record carries a last-modified date of August 31, 2026; the record at its source may have been updated since.
What is the CVSS score of CVE-2026-82455?
CVE-2026-82455 has a CVSS base score of 7.1 (a secondary CVSS source that NVD displays; NVD's own analysis pending).
How do I remediate CVE-2026-82455?
There is nothing to remediate under CVE-2026-82455: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability.