# Path traversal in Tempfile on windows OS due to unsanitized backslashes

Ruby Tempfile on Windows fails to sanitize backslash path traversal in basename/ext, letting user-controlled input create files in arbitrary writable directories.

- Payout: hidden
- Severity: medium
- Program: Ruby
- Found by: bugdiscloseguys
- Disclosed: 2021-04-07
- CVE: CVE-2021-28966
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1131465
- Library page: https://bugbountylibrary.com/r/h1%3A1131465
- Tags: area:oss domain:oss impact:integrity kind:bounty platform:hackerone sev:medium tech:ruby technique:source-review vuln:path-traversal

**Target:** Tempfile library (Ruby stdlib) on Windows
**Root cause:** Tempfile on Windows does not sanitize backslash sequences in the basename and ext arguments, so `\..\..` segments are interpreted as directory traversal when the temp path is constructed.
**Steps:**
1. Call `Tempfile.open(["\\..\\..\\..\\..\\..\\Users\\rootx\\malicious", ".rb"])` on Windows.
2. Observe the resulting path resolves outside the temp dir to `C:/Users/rootx/malicious<rand>.rb`.
3. Confirm file creation via `dir C:\Users\rootx\`.
4. Repeat using the ext argument to achieve the same traversal.
**How found:** Researchers noticed Tempfile accepts user-controlled basename/ext and tested backslash traversal sequences on Windows, observing files created outside the temp directory.
**Exploitation:** Any application passing user-controlled basename or ext to Tempfile on Windows can be tricked into writing attacker-named files into arbitrary writable directories; in Rails apps this could enable RCE by dropping files into sensitive locations.
**Escalation:** Potential RCE in Ruby on Rails applications where user input reaches Tempfile basename/ext.
**Insight:** On Windows, backslash is a path separator; libraries that sanitize only forward slashes in filename components remain traversable. Test basename/ext-style APIs with `\..\` sequences.