CVE-2018-8780

CVE-2018-8780 is a critical directory traversal vulnerability affecting Ruby versions prior to 2.2.10, 2.3.7, 2.4.4, 2.5.1, and 2.6.0-preview1, as well as various distributions of Linux that include these Ruby versions. The vulnerability stems from Ruby's Dir.open, Dir.new, Dir.entries, and Dir.empty? methods failing to properly handle NULL characters, which can lead to unintentional directory traversal. With a CVSS score of 9.1 (CRITICAL), this vulnerability is remotely exploitable with low attack complexity, allowing an unauthenticated attacker to achieve high confidentiality and integrity impacts. Despite its severity, there is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.