PT-2018-9626 · Sharpcompress · Sharpcompress

Odinn1984 · Published 2018-07-25 · Updated 2026-06-05 · CVE-2018-1002206

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: SharpCompress versions prior to 0.21.0

Description: The issue allows attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This is also known as 'Zip-Slip'. The vulnerability is related to a path traversal issue in archive extraction.

Recommendations: For versions prior to 0.21.0, update to version 0.21.0 or later to resolve the issue. As a temporary workaround, consider restricting the extraction of Zip archives to a safe directory to minimize the risk of writing to arbitrary files. Avoid using the vulnerable Zip archive extraction functionality until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-1002206

GHSA-FXH6-W476-HGR4

SNYK-DOTNET-SHARPCOMPRESS-60246

Affected Products

Sharpcompress

References · 10

• 🔥 https://github.com/snyk/zip-slip-vulnerability · Exploit
• 🔥 https://snyk.io/vuln/SNYK-DOTNET-SHARPCOMPRESS-60246 · Exploit
• 🔥 https://snyk.io/research/zip-slip-vulnerability · Exploit
• https://github.com/adamhathcock/sharpcompress/pull/374 · Patch
• https://github.com/adamhathcock/sharpcompress/commit/42b1205fb435de523e6ef8ac5b7bafbe712997f6 · Patch
• https://osv.dev/vulnerability/CVE-2018-1002206 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fxh6-w476-hgr4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1002206 · Security Note
• https://github.com/adamhathcock/sharpcompress/commit/80ceb1c375fdb1b4ffba16528c99089e804ce61f · Note
• https://t.me/cveNotify/166137 · Telegram Post