En resumen
- CVE-2018-1002206 es una vulnerabilidad MEDIO (CVSS 5.5) que afecta a SharpCompress, sharpcompress (adamhathcock).
- Probabilidad de explotación en los próximos 30 días (EPSS): 9.3%, mayor que el 95.4% de las vulnerabilidades.
- Solución: actualizar a 0.21.0 o posterior.
Description
SharpCompress prior to version 0.21 is vulnerable to path traversal issue in archive extraction.
NVD description
SharpCompress before 0.21.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free