During gem extraction, RubyGems does not re‑validate that the resolved path of a symlink stays within the destination directory. An attacker can construct a gem containing a symlink that points outside the extraction root, causing files extracted through that symlink to be written to an arbitrary location on the filesystem. This enables overwriting critical files, potentially leading to privilege escalation or denial of service. The flaw lies in CWE‑59, a path traversal weakness.

Systems running RubyGems before version 4.0.13 are affected, including all deployments that rely on the ruby:rubygems package. The vulnerability applies regardless of the operating system, as it is triggered during the extraction process of any gem installed to a writable location.

The flaw is rated a CVSS score of 6.9, indicating a medium severity risk. No EPSS score is available, so the current exploitation probability is unknown, but the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread active exploitation at the time of analysis. The attack requires the ability to install a crafted gem, which can be done remotely if a public gem source is exploitable or locally if an attacker has file‑system write access to the gem installation directory. The path traversal allows arbitrary file creation, so the impact can be extensive if executed with elevated privileges.