CVE-2021-28966 in the critical feed json
Tempfile on Windows path traversal vulnerability
published 2021-05-06 5 y ago modified 2026-09-08 2 mo ago also BIT-ruby-2021-28966 , BIT-ruby-min-2021-28966 , EUVD-2021-0931 , GHSA-46f2-3v63-3xrp , JLSEC-2026-1283
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 58.0%
- EPSS 58.0% chance of exploitation in 30 days, percentile 99%
- public exploits
- 0
- none known
Summary
In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.
Patch / fix
- rubygems tmpdir 0.1.2
- bitnami ruby 2.7.3, 3.0.1
- bitnami ruby-min 2.7.3, 3.0.1
- ruby-lang ruby 2.7.3, 3.0.1
- ruby Alpine 3.10 2.5.9-r0
- ruby Alpine 3.11 2.6.7-r0
- ruby Alpine 3.24, Alpine 3.23, Alpine 3.22 +10 more 2.7.3-r0
alpine advisories ALPINE-CVE-2021-28966
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- github.com/ruby/tmpdir@93798c0 commit
- github.com/ruby/tmpdir#8 pull request
- hackerone.com/reports/1131465 advisory
Exploit prediction
58.04% chance of exploitation in the next 30 days, higher than 99% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- hackerone.com https://hackerone.com/reports/1131465 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | tmpdir | <0.1.2 |
0.1.2 |
| bitnami | ruby | <2.7.3 >=3.0.0, <3.0.1 |
2.7.3 3.0.1 |
| bitnami | ruby-min | <2.7.3 >=3.0.0, <3.0.1 |
2.7.3 3.0.1 |
| julia | ruby_jll | all versions |
no fix listed |
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
hackerone.com
/reports/1131465
web, exploit, issue-tracking, patch, third-party-advisory, advisory
-
github.com
/ruby/tmpdir/pull/8
web
-
github.com
/ruby/tmpdir/commit/93798c01cb7c10476e50a4d80130a329ba47f348
web
-
security.netapp.com
/advisory/ntap-20210902-0004/
third-party-advisory, advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2021-28966
advisory, web
-
github.com
/ruby/tmpdir
package
-
github.com
/rubysec/ruby-advisory-db/blob/master/gems/tmpdir/CVE-2021-28966.yml
web
-
rubygems.org
/gems/tmpdir
web
-
security.netapp.com
/advisory/ntap-20210902-0004
web
-
ruby-lang.org
/en/news/2021/04/05/tempfile-path-traversal-on-windows-cve-2021-28966
web
Sources
- CVE List CVE-2021-28966
- GitHub Advisory GHSA-46f2-3v63-3xrp
- NVD CVE-2021-28966
- OSV BIT-ruby-2021-28966
- OSV BIT-ruby-min-2021-28966
- OSV JLSEC-2026-1283
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.