sharpziplib project sharpziplib vulnerabilities

Latest sharpziplib project sharpziplib CVEs

Newest publication first

1. CVE-2021-32841 Path Traversal in SharpZipLib

   Published 2022-01-26

   Medium·CVSS 5.3 EPSS 1.1%

   SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.3.0 and prior to version 1.3.3, a check was added if the destination file is under destination directory. However, it is not enforced that destDir ends with slash. If the destDir is not slash termi...

2. CVE-2021-32842 Path Traversal in SharpZipLib

   Published 2022-01-26

   Medium·CVSS 5.3 EPSS 0.90%

   SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.0.0 and prior to version 1.3.3, a check was added if the destination file is under a destination directory. However, it is not enforced that _baseDirectory ends with slash. If the _baseDirectory is...

3. CVE-2021-32840 Path Traversal in SharpZipLib

   Published 2022-01-26

   Critical·CVSS 9.8 EPSS 1.9%

   SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Prior to version 1.3.3, a TAR file entry ../evil.txt may be extracted in the parent directory of destFolder. This leads to arbitrary file write that may lead to code execution. The vulnerability was patched in versio...

4. CVE-2018-1002208 Improper Limitation of a Pathname to a Restricted Directory in SharpZipLib

   Published 2018-07-25

   Medium·CVSS 5.5 EPSS 9.9%

   SharpZipLib before 1.0 RC1 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.