CVE-2019-8320

A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user's machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system.

• CWE-22

• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
• https://access.redhat.com/errata/RHSA-2019:1429
• https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.htmlVendor Advisory
• https://hackerone.com/reports/317321Exploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
• https://access.redhat.com/errata/RHSA-2019:1429
• https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.htmlVendor Advisory
• https://hackerone.com/reports/317321Exploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html

Published

Jun 6, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-8314An issue was discovered on D-Link DIR-878 devices with firmw…8.8
• CVE-2019-8315An issue was discovered on D-Link DIR-878 devices with firmw…8.8
• CVE-2019-8316An issue was discovered on D-Link DIR-878 devices with firmw…8.8
• CVE-2019-8317An issue was discovered on D-Link DIR-878 devices with firmw…8.8
• CVE-2019-8318An issue was discovered on D-Link DIR-878 devices with firmw…8.8
• CVE-2019-8319An issue was discovered on D-Link DIR-878 devices with firmw…8.8
• CVE-2019-8321An issue was discovered in RubyGems 2.6 and later through 3.…7.5
• CVE-2019-8322An issue was discovered in RubyGems 2.6 and later through 3.…7.5
• CVE-2019-8323An issue was discovered in RubyGems 2.6 and later through 3.…7.5
• CVE-2019-8324An issue was discovered in RubyGems 2.6 and later through 3.…8.8
• CVE-2019-8325An issue was discovered in RubyGems 2.6 and later through 3.…7.5
• CVE-2019-8331In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is pos…6.1