VYPR
← All advisories
High severityNVD Advisory· Published Jun 6, 2019· Updated Aug 4, 2024

CVE-2019-8320

CVE-2019-8320

Description

A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user's machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Directory traversal in RubyGems prior to 3.0.3/2.7.8 allows malicious gems to delete arbitrary files via symlink exploitation, potentially causing data loss or system unusability.

Vulnerability

A directory traversal vulnerability exists in RubyGems versions 2.7.6 through 3.0.2. The gem command, before creating new directories or touching files, deletes the target destination without properly checking for symlinks. If the destination is behind a symlink, a malicious gem can cause deletion of arbitrary files on the user's system [2][4].

Exploitation

An attacker must craft a malicious gem that, when installed, writes to a path that is a symlink to a sensitive location (e.g., /tmp or /usr). The victim must install the gem, often with elevated privileges (e.g., via sudo). Due to predictable paths, the attacker can target critical system files [2].

Impact

Successful exploitation leads to arbitrary file deletion, which can result in data loss or render the system unusable. The vulnerability is considered high severity [1].

Mitigation

RubyGems released fixed versions 3.0.3 and 2.7.8 [4]. Red Hat issued RHSA-2019:1429 for Red Hat Enterprise Linux [1]. Users should upgrade RubyGems immediately.

References
  1. https://access.redhat.com/errata/RHSA-2019:1429
  2. NVD - CVE-2019-8320
  3. March 2019 Security Advisories

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
rubygems-updateRubyGems
>= 2.7.6, < 2.7.92.7.9
rubygems-updateRubyGems
>= 3.0.0, < 3.0.33.0.3

Affected products

29

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

8

News mentions

0

No linked articles in our index yet.