nuget sharpcompress vulnerabilities

Latest nuget sharpcompress CVEs

Newest publication first

1. CVE-2026-44788 SharpCompress: Directory traversal via directory entries in WriteToDirectory (zip slip variant)

   Published 2026-05-26

   Medium·CVSS 6.5 EPSS 0.31%

   SharpCompress is a fully managed C# library to deal with many compression types and formats. In 0.47.4 and earlier, a path traversal vulnerability in IArchive.WriteToDirectory() allows a malicious archive to create directories outside the intended extraction root. For TAR archive...

2. CVE-2021-39208 WriteEntryToDirectory used for an archive extraction is vulnerable to partial path traversal.

   Published 2021-09-16

   Medium·CVSS 4.3 EPSS 1.2%

   SharpCompress is a fully managed C# library to deal with many compression types and formats. Versions prior to 0.29.0 are vulnerable to partial path traversal. SharpCompress recreates a hierarchy of directories under destinationDirectory if ExtractFullPath is set to true in optio...

3. CVE-2018-1002206 Directory Traversal in SharpCompress

   Published 2018-07-25

   Medium·CVSS 5.5 EPSS 9.3%

   SharpCompress before 0.21.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.