Arbitrary File Write via Archive Extraction (Zip Slip) Affecting system.io.compression.zipfile package, versions [,4.3.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
2 May 2019
12 Sep 2018
How to fix?
System.IO.Compression.ZipFile to version 4.3.0 or higher.
System.IO.Compression.ZipFile provides classes that support the compression and decompression of streams using file system paths.
Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip). An attacker could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker would have limited control over the destination of the files and directories. To exploit the vulnerability, they must send a specially crafted file to a vulnerable system.