The flaw in rubyzip versions prior to 3.4.0 allows a carefully crafted ZIP entry to bypass path validation and extract files outside the intended destination. This results in the ability for an attacker to create or overwrite files at arbitrary locations within a directory that shares the same prefix, effectively granting write permission to the filesystem. Because the vulnerability stems from CWE‑22, it can compromise confidentiality, integrity, or availability when critical files are altered or introduced.

Ruby applications that depend on rubyzip and use Zip::Entry#extract, including any installations that have not upgraded beyond version 3.3.x. The affected versions are any before 3.4.0; the vendor is rubyzip, and the product is commonly referred to as the rubyzip gem. Systems that load untrusted ZIP archives from external sources are at risk.

The CVSS score of 8.7 indicates a high severity of this vulnerability. EPSS is currently not available, and the vulnerability is not listed in the CISA KEV catalog. Likely, exploitation requires that an attacker provide a malicious ZIP file that the vulnerable application will extract. If the application performs extraction on user‑supplied input or from remote locations, the attacker can place arbitrary files beneath the extraction directory by leveraging the sibling‑directory prefix bypass.