CVE-2021-28966: Ruby-Lang Ruby

High severity, CVSS 7.5. EPSS: 58% chance of exploitation in the next 30 days.

In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.

Affected products

• Ruby-Lang Ruby: before 2.7.3 (fixed in 2.7.3); from 3.0.0, before 3.0.1 (fixed in 3.0.1)

Published 2021-07-30. Last modified 2026-06-17.