PT-2018-9626 · Sharpcompress · Sharpcompress

Odinn1984 · Publicado 2018-07-25 · Atualizado 2026-06-05 · CVE-2018-1002206

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: SharpCompress versions prior to 0.21.0

Description: The issue allows attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This is also known as 'Zip-Slip'. The vulnerability is related to a path traversal issue in archive extraction.

Recommendations: For versions prior to 0.21.0, update to version 0.21.0 or later to resolve the issue. As a temporary workaround, consider restricting the extraction of Zip archives to a safe directory to minimize the risk of writing to arbitrary files. Avoid using the vulnerable Zip archive extraction functionality until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-1002206

GHSA-FXH6-W476-HGR4

SNYK-DOTNET-SHARPCOMPRESS-60246

Produtos afetados

Sharpcompress

Referências · 10

• 🔥 https://github.com/snyk/zip-slip-vulnerability · Exploit
• 🔥 https://snyk.io/vuln/SNYK-DOTNET-SHARPCOMPRESS-60246 · Exploit
• 🔥 https://snyk.io/research/zip-slip-vulnerability · Exploit
• https://github.com/adamhathcock/sharpcompress/pull/374 · Correção
• https://github.com/adamhathcock/sharpcompress/commit/42b1205fb435de523e6ef8ac5b7bafbe712997f6 · Correção
• https://github.com/adamhathcock/sharpcompress/commit/80ceb1c375fdb1b4ffba16528c99089e804ce61f · Nota
• https://t.me/cveNotify/166137 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2018-1002206 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-fxh6-w476-hgr4 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1002206 · Nota de Segurança