Description
SharpCompress before 0.21.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SharpCompress | SharpCompress | unspecified – < 0.21.0 | 0.21.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | SharpCompress | < 0.21.0 | 0.21.0 | GHSA-fxh6-w476-hgr4 |