Arbitrary File Write via Archive Extraction (Zip Slip) Affecting system.io.compression.zipfile package, versions [,4.3.0)
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DOTNET-SYSTEMIOCOMPRESSIONZIPFILE-174570
- published 2 May 2019
- disclosed 12 Sep 2018
- credit Unknown
Introduced: 12 Sep 2018
CVE-2018-8416 Open this link in a new tabHow to fix?
Upgrade System.IO.Compression.ZipFile
to version 4.3.0 or higher.
Overview
System.IO.Compression.ZipFile provides classes that support the compression and decompression of streams using file system paths.
Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip). An attacker could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker would have limited control over the destination of the files and directories. To exploit the vulnerability, they must send a specially crafted file to a vulnerable system.