rubyzip versions prior to 3.4.0 contain a path traversal vulnerability in the Zip::Entry#extract method. The flaw stems from improper validation of extraction paths using prefix comparison without trailing directory separators. Attackers can craft malicious archive entries with names such as '../upload_backup/owned.sh' to write files outside the intended extraction directory. The vulnerability allows files to be placed into sibling directories that share a prefix with the destination path. This could lead to arbitrary file write, potentially enabling remote code execution or privilege escalation. The issue has been patched in rubyzip version 3.4.0 via a commit that corrects the path validation logic. Users are advised to upgrade immediately to mitigate the risk.
