Directory Traversal in SharpCompress

中危 5.5CVE-2018-1002206 · GHSA-fxh6-w476-hgr4 · SNYK-DOTNET-SHARPCOMPRESS-60246 · Published 25/07/2018 · updated 17/06/2026

要点

CVE-2018-1002206 是影响 SharpCompress, sharpcompress (adamhathcock) 的中危 (CVSS 5.5)漏洞。
未来 30 天内被利用的概率（EPSS）：9.3%，高于 95.4% 的漏洞。
修复：升级到 0.21.0 或更高版本。

Package	Affected versions	Patched versions
SharpCompress NuGet	`< 0.21.0`	`0.21.0`
sharpcompress adamhathcock	`< 0.21.0`	`0.21.0`

Description

SharpCompress prior to version 0.21 is vulnerable to path traversal issue in archive extraction.

NVD description

SharpCompress before 0.21.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

References

nvd.nist.gov/vuln/detail/CVE-2018-1002206 · ADVISORY
adamhathcock/sharpcompress#374 · WEB
adamhathcock/sharpcompress commit 42b1205 · WEB
adamhathcock/sharpcompress commit 80ceb1c · WEB
snyk/zip-slip-vulnerability · WEB
snyk.io/research/zip-slip-vulnerability · WEB
snyk.io/vuln/SNYK-DOTNET-SHARPCOMPRESS-60246 · WEB

SharpCompress 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

SharpCompress

NuGet

< 0.21.0

0.21.0

sharpcompress

adamhathcock

< 0.21.0

0.21.0

Description

SharpCompress prior to version 0.21 is vulnerable to path traversal issue in archive extraction.

NVD description

SharpCompress 的其他漏洞

查看全部 →