Directory Traversal in SharpCompress

MEDIO 5.5CVE-2018-1002206 · GHSA-fxh6-w476-hgr4 · SNYK-DOTNET-SHARPCOMPRESS-60246 · Published 25/07/2018 · updated 17/06/2026

In breve

CVE-2018-1002206 è una vulnerabilità MEDIO (CVSS 5.5) che riguarda SharpCompress, sharpcompress (adamhathcock).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 9.3%, superiore al 95.4% delle vulnerabilità.
Correzione: aggiornare a 0.21.0 o successiva.

Package	Affected versions	Patched versions
SharpCompress NuGet	`< 0.21.0`	`0.21.0`
sharpcompress adamhathcock	`< 0.21.0`	`0.21.0`

Description

SharpCompress prior to version 0.21 is vulnerable to path traversal issue in archive extraction.

NVD description

SharpCompress before 0.21.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

References

nvd.nist.gov/vuln/detail/CVE-2018-1002206 · ADVISORY
adamhathcock/sharpcompress#374 · WEB
adamhathcock/sharpcompress commit 42b1205 · WEB
adamhathcock/sharpcompress commit 80ceb1c · WEB
snyk/zip-slip-vulnerability · WEB
snyk.io/research/zip-slip-vulnerability · WEB
snyk.io/vuln/SNYK-DOTNET-SHARPCOMPRESS-60246 · WEB

Altre vulnerabilità di SharpCompress

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

SharpCompress

NuGet

< 0.21.0

0.21.0

sharpcompress

adamhathcock

< 0.21.0

0.21.0

Description

SharpCompress prior to version 0.21 is vulnerable to path traversal issue in archive extraction.

NVD description

Altre vulnerabilità di SharpCompress

Vedi tutto →