Homepage
About Snyk

Arbitrary File Write via Archive Extraction (Zip Slip) Affecting system.io.compression.zipfile package, versions [,4.3.0)

0.0
medium

Snyk CVSS

    Attack Complexity Low
    Integrity High

    Threat Intelligence

    EPSS 0.26% (66th percentile)
Expand this section
NVD
6.5 medium
Expand this section
Red Hat
5.5 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-DOTNET-SYSTEMIOCOMPRESSIONZIPFILE-174570
  • published 2 May 2019
  • disclosed 12 Sep 2018
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 12 Sep 2018

CVE-2018-8416 Open this link in a new tab
CWE-434 Open this link in a new tab
First added by Snyk

How to fix?

Upgrade System.IO.Compression.ZipFile to version 4.3.0 or higher.

Overview

System.IO.Compression.ZipFile provides classes that support the compression and decompression of streams using file system paths.

Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip). An attacker could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker would have limited control over the destination of the files and directories. To exploit the vulnerability, they must send a specially crafted file to a vulnerable system.