CVE-2018-6914: canonical ubuntu_linux
Vulnerability summary
CVE-2018-6914 is a high (CVSS 7.5) vulnerability in canonical ubuntu_linux. EPSS estimates a 10.16% chance of exploitation in the next 30 days, higher than 95.6% of scored vulnerabilities.
Severe, CVSS 7.5 (NVD); no exploitation reported by the 5 checked sources; EPSS 10% (FIRST, 04-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 13 · Related 4Timeline
- 03-04-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 might allow attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
10.16%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
No change 0.00 pp
From 10.16% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu3 products
- ruby1.9.1< 1.9.3.484-2ubuntu1.11
- ruby2.0< 2.0.0.484-1ubuntu2.9
- ruby2.3< 2.3.1-2~16.04.9
Alpine1 product
- ruby≥ 2.2.0, < 2.5.1-r0 | ≥ 2.2.0, < 2.3.7-r0 | ≥ 2.2.0, < 2.4.4-r0
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 17.10
Debian1 product
- debian_linuxEOL7.0 | 8.0 | 9.0
Redhat1 product
- enterprise_linuxEOL6.0 | 7.0 | 7.4 | 7.5 | 7.6
Ruby-lang1 product
- rubyEOL≥ 2.2.0, < 2.2.10 | ≥ 2.3.0, < 2.3.7 | ≥ 2.4.0, < 2.4.4 | ≥ 2.5.0, < 2.5.1 | 2.6.0:preview1
6 vendors · 8 products
References
22 links
lists.debian.org/debian-lts-announce/2018/04/msg00023.htmlMailing ListX Refsource MLISTThird Party Advisory- lists.debian.org/debian-lts-announce/2018/07/msg00012.htmlMailing ListX Refsource MLISTThird Party Advisory
Show all 22 references
- lists.debian.org/debian-lts-announce/2018/04/msg00024.htmlMailing ListX Refsource MLISTThird Party Advisory