CVE-2021-28966: Ruby TmpDir path traversal on Windows allows crafted path injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 7.5 with network reachability, no authentication, and high EPSS plus an exploit-tagged reference make this a serious integrity risk despite no KEV listing.

What it is

Ruby through 3.0 on Windows mishandles paths when a web application passes a parameter to TmpDir, allowing a crafted path to escape the intended temporary directory. This is a path traversal flaw (CWE-22) that matters because untrusted input reaching TmpDir can redirect file operations outside the temp directory.

Impact

An attacker can influence where temporary files are created or accessed, enabling writes or reads outside the intended directory. The CVSS vector shows no confidentiality impact but high integrity impact, so the primary gain is tampering with files.

Attack surface

Reached remotely over the network (AV:N) with no authentication (PR:N) and no user interaction (UI:N) when a web application passes an attacker-controlled parameter to TmpDir. The flaw is specific to Ruby on Windows.

Exploitation

Not listed in CISA KEV, but EPSS is 0.57133 (99th percentile) and the HackerOne reference is tagged Exploit, indicating public exploit detail exists.

What to do

• Upgrade Ruby to a version after 3.0 that contains the fix referenced in the HackerOne report.
• Validate and sanitize any user-supplied value passed to TmpDir; do not accept raw path input.
• Run Ruby web applications with least privilege and restrict write access to the temp directory.
• Apply vendor advisories (for example NetApp) for affected bundled Ruby components.

Detection

• Monitor for TmpDir usage where the path argument originates from request parameters.
• Alert on file creation or access events outside the expected temp directory by Ruby processes.
• Review web application logs for path traversal patterns in parameters feeding temp file handling.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.