Arbitrary File Write via Archive Extraction (Zip Slip) Affecting package, versions [,4.3.0)

  • Attack Complexity


  • Integrity


Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id


  • published

    2 May 2019

  • disclosed

    12 Sep 2018

  • credit


How to fix?

Upgrade System.IO.Compression.ZipFile to version 4.3.0 or higher.


System.IO.Compression.ZipFile provides classes that support the compression and decompression of streams using file system paths.

Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip). An attacker could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker would have limited control over the destination of the files and directories. To exploit the vulnerability, they must send a specially crafted file to a vulnerable system.