RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be written outside of it, breaking the extraction safety boundary. The fix resolves the real path of the parent directory before writing and raises Gem::Package::PathError if it escapes the destination directory.

CVE-2026-82455 describes a path traversal vulnerability in RubyGems where symlink resolution during gem extraction is not re-validated for path containment. A pre-existing symlink inside the destination directory that points outside the extraction root can cause extracted files to be written to arbitrary locations outside the intended destination. This breaks the extraction safety boundary and could allow an attacker to write files to sensitive locations on the filesystem. The fix involves resolving the real path of the parent directory before writing and raising a Gem::Package::PathError if the resolved path escapes the destination directory. The vulnerability affects RubyGems versions prior to 4.0.13. A patch has been committed to the ruby/rubygems GitHub repository and a pull request has been merged to address the issue.