Description
DotNetZip.Semvered before 1.11.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| DotNetZip | DotNetZip.Semvered | unspecified – < 1.11.0 | 1.11.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | DotNetZip | < 1.11.0 | 1.11.0 | GHSA-7378-6268-4278 |
Advisories 1
- ICSA-23-262-03 Omron Engineering Software Zip-Slip CISA ICS & IT advisories · Sep 19, 2023