Sharpcompress · Sharpcompress · CVE-2018-1002206
Name of the Vulnerable Software and Affected Versions:
SharpCompress versions prior to 0.21.0
Description:
The issue allows attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This is also known as 'Zip-Slip'. The vulnerability is related to a path traversal issue in archive extraction.
Recommendations:
For versions prior to 0.21.0, update to version 0.21.0 or later to resolve the issue. As a temporary workaround, consider restricting the extraction of Zip archives to a safe directory to minimize the risk of writing to arbitrary files. Avoid using the vulnerable Zip archive extraction functionality until the issue is resolved.