CVE-2021-32842: Path Traversal in SharpZipLib

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-01-26 · updated 2026-06-17
Weakness: CWE-22

Description

SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.0.0 and prior to version 1.3.3, a check was added if the destination file is under a destination directory. However, it is not enforced that `_baseDirectory` ends with slash. If the _baseDirectory is not slash terminated like `/home/user/dir` it is possible to create a file with a name thats begins as the destination directory one level up from the directory, i.e. `/home/user/dir.sh`. Because of the file name and destination directory constraints, the arbitrary file creation impact is limited and depends on the use case. Version 1.3.3 fixed this vulnerability.

Affected products

icsharpcode sharpziplib: from 1.0.0 before 1.3.3 — fixed in 1.3.3

How to fix

Upgrade to a fixed version: icsharpcode sharpziplib 1.3.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-32842 or the next vulnerability affects your stack