Withdrawn: this CVE is not a vulnerability
The assigning CNA withdrew CVE-2026-82455 on 11 September 2026, and it carries the Rejected state at CVE.org and NVD. It must not be treated as a live finding. Its pre-withdrawal severity, score and exploitability are withheld below; the record itself is kept because withdrawals are reversible and because the reject reason is the correction worth publishing.
CVE-2026-82455
RubyGems before 4.0.13 Path Traversal via Symlink Resolution
Description
Rejected reason: The RubyGems maintainers determined that the reported symlink-following behavior during gem extraction is not a security vulnerability, so no vulnerability exists for this record to describe.
INFO
Published Date :
Aug. 29, 2026, 2:16 p.m.
Last Modified :
Sept. 11, 2026, 12:16 p.m.
Remotely Exploit :
—
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | MITRE-CVE | ||||
| CVSS 4.0 | MEDIUM | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 4.0 | MEDIUM | [email protected] |
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-82455 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-82455 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Rejected by [email protected]
Sep. 11, 2026
Action Type Old Value New Value -
CVE Modified by [email protected]
Sep. 11, 2026
Action Type Old Value New Value Changed Description RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be written outside of it, breaking the extraction safety boundary. The fix resolves the real path of the parent directory before writing and raises Gem::Package::PathError if it escapes the destination directory. Rejected reason: The RubyGems maintainers determined that the reported symlink-following behavior during gem extraction is not a security vulnerability, so no vulnerability exists for this record to describe. Removed CVSS V4.0 VulnCheck: AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Removed CVSS V3.1 VulnCheck: AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H Removed CVSS V3.1 nvd-ai-agent-0.3.0-gemma-4-31B-it: AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N Removed CWE VulnCheck: CWE-59 Removed CWE nvd-ai-agent-0.3.0-gemma-4-31B-it: CWE-59 Removed CPE Configuration OR *cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:* versions from (including) 3.2.30 up to (excluding) 4.0.13 Added Affected Affected value removed. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/82xxx/CVE-2026-82455.json">CVE-2026-82455</a> Removed Reference VulnCheck: https://github.com/ruby/rubygems Removed Reference VulnCheck: https://github.com/ruby/rubygems/commit/103ca4230deacb31b9fcd813de109e83b5fc71ac Removed Reference VulnCheck: https://github.com/ruby/rubygems/pull/9493 Removed Reference VulnCheck: https://www.vulncheck.com/advisories/rubygems-before-4.0.13-path-traversal-via-symlink-resolution Removed Reference nvd-ai-agent-0.3.0-gemma-4-31B-it: https://github.com/ruby/rubygems Removed Reference nvd-ai-agent-0.3.0-gemma-4-31B-it: https://github.com/ruby/rubygems/commit/103ca4230deacb31b9fcd813de109e83b5fc71ac Removed Reference nvd-ai-agent-0.3.0-gemma-4-31B-it: https://github.com/ruby/rubygems/pull/9493 Removed Reference nvd-ai-agent-0.3.0-gemma-4-31B-it: https://www.vulncheck.com/advisories/rubygems-before-4.0.13-path-traversal-via-symlink-resolution Removed Reference Type nvd-ai-agent-0.3.0-gemma-4-31B-it: https://github.com/ruby/rubygems Types: Product Removed Reference Type nvd-ai-agent-0.3.0-gemma-4-31B-it: https://github.com/ruby/rubygems/commit/103ca4230deacb31b9fcd813de109e83b5fc71ac Types: Exploit, Patch Removed Reference Type nvd-ai-agent-0.3.0-gemma-4-31B-it: https://github.com/ruby/rubygems/pull/9493 Types: Patch, Vendor Advisory Removed Reference Type nvd-ai-agent-0.3.0-gemma-4-31B-it: https://www.vulncheck.com/advisories/rubygems-before-4.0.13-path-traversal-via-symlink-resolution Types: Exploit, Patch, Third Party Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 31, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-82455', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-31T18:20:28.286576Z'} -
New CVE Received by [email protected]
Aug. 29, 2026
Action Type Old Value New Value Added Description RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be written outside of it, breaking the extraction safety boundary. The fix resolves the real path of the parent directory before writing and raises Gem::Package::PathError if it escapes the destination directory. Added CVSS V4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H Added CWE CWE-59 Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/82xxx/CVE-2026-82455.json">CVE-2026-82455</a> Added Reference https://github.com/ruby/rubygems Added Reference https://github.com/ruby/rubygems/commit/103ca4230deacb31b9fcd813de109e83b5fc71ac Added Reference https://github.com/ruby/rubygems/pull/9493 Added Reference https://www.vulncheck.com/advisories/rubygems-before-4.0.13-path-traversal-via-symlink-resolution