CVE-2018-1000544: Debian Linux

Critical severity, CVSS 9.8. EPSS: 4.4% chance of exploitation in the next 30 days.

rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file that contains symlinks or files with absolute pathnames "../" to write arbitrary files to the filesystem..

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only
• Red Hat Cloudforms: version 4.6 only
• Rubyzip Project Rubyzip: up to and including 1.2.1

Published 2018-06-26. Last modified 2026-06-17.