DotNetZip Directory Traversal vulnerability

CRITICAL 9.8CVE-2024-48510 · GHSA-xhg6-9j5j-w4vf · Published 13/11/2024 · updated 17/06/2026

In short

CVE-2024-48510 is a CRITICAL (CVSS 9.8) vulnerability affecting DotNetZip, ProDotNetZip, dotnetzip.semverd (dotnetzip.semverd project).
Chance of exploitation in the next 30 days (EPSS): 2.0%, higher than 80.9% of all vulnerabilities.
Fix: update to 1.19.0 or later.

Package	Affected versions	Patched versions
DotNetZip NuGet	`≥ 1.10.1, ≤ 1.16.0`	No fix yet
ProDotNetZip NuGet	`< 1.19.0`	`1.19.0`
dotnetzip.semverd dotnetzip.semverd_project	`≥ 1.10.1, ≤ 1.16.0`	No fix yet
prodotnetzip mihula	`< 1.19.0`	`1.19.0`

Description

Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component.

NVD description

Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

References

nvd.nist.gov/vuln/detail/CVE-2024-48510 · ADVISORY
mihula/ProDotNetZip#21 · WEB
mihula/ProDotNetZip commit 18486ad · WEB
gist.github.com/thomas-chauchefoin-bentley-systems/855218959116f870f08857cce2aec731 · WEB
haf/DotNetZip.Semverd · PACKAGE
haf/DotNetZip.Semverd · WEB
nuget.org/packages/DotNetZip · WEB
nuget.org/packages/DotNetZip · Product

More vulnerabilities in DotNetZip

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

DotNetZip

NuGet

≥ 1.10.1, ≤ 1.16.0

No fix yet

ProDotNetZip

NuGet

< 1.19.0

1.19.0

dotnetzip.semverd

dotnetzip.semverd_project

≥ 1.10.1, ≤ 1.16.0

No fix yet

prodotnetzip

mihula

< 1.19.0

1.19.0

Description

Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component.

NVD description