Directory Traversal in SharpCompress

MITTEL 5.5CVE-2018-1002206 · GHSA-fxh6-w476-hgr4 · SNYK-DOTNET-SHARPCOMPRESS-60246 · Published 25/07/2018 · updated 17/06/2026

Kurz gesagt

CVE-2018-1002206 ist eine Schwachstelle (MITTEL (CVSS 5.5)) in SharpCompress, sharpcompress (adamhathcock).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 9.3%, höher als bei 95.4% aller Schwachstellen.
Abhilfe: auf 0.21.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
SharpCompress NuGet	`< 0.21.0`	`0.21.0`
sharpcompress adamhathcock	`< 0.21.0`	`0.21.0`

Description

SharpCompress prior to version 0.21 is vulnerable to path traversal issue in archive extraction.

NVD description

SharpCompress before 0.21.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

References

nvd.nist.gov/vuln/detail/CVE-2018-1002206 · ADVISORY
adamhathcock/sharpcompress#374 · WEB
adamhathcock/sharpcompress commit 42b1205 · WEB
adamhathcock/sharpcompress commit 80ceb1c · WEB
snyk/zip-slip-vulnerability · WEB
snyk.io/research/zip-slip-vulnerability · WEB
snyk.io/vuln/SNYK-DOTNET-SHARPCOMPRESS-60246 · WEB

Weitere Schwachstellen in SharpCompress

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

SharpCompress

NuGet

< 0.21.0

0.21.0

sharpcompress

adamhathcock

< 0.21.0

0.21.0

Description

SharpCompress prior to version 0.21 is vulnerable to path traversal issue in archive extraction.

NVD description

Weitere Schwachstellen in SharpCompress

Alle anzeigen →