DotNetZip Directory Traversal vulnerability

KRITISCH 9.8CVE-2024-48510 · GHSA-xhg6-9j5j-w4vf · Published 13/11/2024 · updated 17/06/2026

Kurz gesagt

CVE-2024-48510 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in DotNetZip, ProDotNetZip, dotnetzip.semverd (dotnetzip.semverd project).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.0%, höher als bei 80.9% aller Schwachstellen.
Abhilfe: auf 1.19.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
DotNetZip NuGet	`≥ 1.10.1, ≤ 1.16.0`	No fix yet
ProDotNetZip NuGet	`< 1.19.0`	`1.19.0`
dotnetzip.semverd dotnetzip.semverd_project	`≥ 1.10.1, ≤ 1.16.0`	No fix yet
prodotnetzip mihula	`< 1.19.0`	`1.19.0`

Description

Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component.

NVD description

Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

References

nvd.nist.gov/vuln/detail/CVE-2024-48510 · ADVISORY
mihula/ProDotNetZip#21 · WEB
mihula/ProDotNetZip commit 18486ad · WEB
gist.github.com/thomas-chauchefoin-bentley-systems/855218959116f870f08857cce2aec731 · WEB
haf/DotNetZip.Semverd · PACKAGE
haf/DotNetZip.Semverd · WEB
nuget.org/packages/DotNetZip · WEB
nuget.org/packages/DotNetZip · Product

Weitere Schwachstellen in DotNetZip

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

DotNetZip

NuGet

≥ 1.10.1, ≤ 1.16.0

No fix yet

ProDotNetZip

NuGet

< 1.19.0

1.19.0

dotnetzip.semverd

dotnetzip.semverd_project

≥ 1.10.1, ≤ 1.16.0

No fix yet

prodotnetzip

mihula

< 1.19.0

1.19.0

Description

Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component.

NVD description