In short
- CVE-2018-1002206 is a MEDIUM (CVSS 5.5) vulnerability affecting SharpCompress, sharpcompress (adamhathcock).
- Chance of exploitation in the next 30 days (EPSS): 9.3%, higher than 95.4% of all vulnerabilities.
- Fix: update to 0.21.0 or later.
Description
SharpCompress prior to version 0.21 is vulnerable to path traversal issue in archive extraction.
NVD description
SharpCompress before 0.21.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
More vulnerabilities in SharpCompress
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free