https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 15:16:01 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-44788 <p>SharpCompress is a fully managed C# library to deal with many compression types and formats. In 0.47.4 and earlier, a path traversal vulnerability in IArchive.WriteToDirectory() allows a malicious archive to create directories outside the intended extraction root. For TAR archives, this can be escalated to arbitrary file writes by chaining with a symlink entry, giving a full write primitive on the target filesystem subject to the permissions of the running process.</p> <p>SharpCompress is a fully managed C# library to deal with many compression types and formats. In 0.47.4 and earlier, a path traversal vulnerability in IArchive.WriteToDirectory() allows a malicious archive to create directories outside the intended extraction root. For TAR archives, this can be escalated to arbitrary file writes by chaining with a symlink entry, giving a full write primitive on the target filesystem subject to the permissions of the running process.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-44788 https://vulnerability.circl.lu/vuln/ghsa-6c8g-7p36-r338 <p><strong>Affected:</strong> NuGet: SharpCompress</p> <p>### Summary</p> <p>A path traversal vulnerability in `IArchive.WriteToDirectory()` allows a malicious archive to create directories outside the intended extraction root. For TAR archives, this can be escalated to arbitrary file writes by chaining with a symlink entry, giving a full write primitive on the target filesystem subject to the permissions of the running process.</p> <p>### Details</p> <p>The vulnerable code is in the directory-entry branch of `WriteToDirectoryInternal` (sync, `IArchiveExtensions.cs:48–61`) and `WriteToDirectoryAsyncInternal` (async, `IAsyncArchiveExtensions.cs:70–84`):</p> <p>```csharp var dirPath = Path.Combine(destinationDirectory, entry.Key); Directory.CreateDirectory(Path.GetDirectoryName(dirPath + &#34;/&#34;)); ```</p> <p>No `Path.GetFullPath()` normalisation and no bounds check are applied before the `Directory.CreateDirectory` call. Two .NET `Path.Combine` behaviours make this exploitable:</p> <p>- **Relative traversal**: `Path.Combine(&#34;/safe/extract&#34;, &#34;../../evil&#34;)` → the OS resolves `..` segments on the raw path, placing the directory outside the extraction root. - **Absolute path override**: `Path.Combine(&#34;/safe/extract&#34;, &#34;/tmp/evil&#34;)` → returns `&#34;/tmp/evil&#34;` — the base is discarded entirely for rooted paths.</p> <p>File entries are **not** directly affected — they route through `ExtractionMethods.WriteEntryToDirectory` which applies the correct guard (`GetFullPath` + `StartsWith`, see `ExtractionMethods.cs:54–65`). The directory-entry branch is a separate fast-path that was added witho…</p> <p><strong>Affected:</strong> NuGet: SharpCompress</p> <p>### Summary</p> <p>A path traversal vulnerability in `IArchive.WriteToDirectory()` allows a malicious archive to create directories outside the intended extraction root. For TAR archives, this can be escalated to arbitrary file writes by chaining with a symlink entry, giving a full write primitive on the target filesystem subject to the permissions of the running process.</p> <p>### Details</p> <p>The vulnerable code is in the directory-entry branch of `WriteToDirectoryInternal` (sync, `IArchiveExtensions.cs:48–61`) and `WriteToDirectoryAsyncInternal` (async, `IAsyncArchiveExtensions.cs:70–84`):</p> <p>```csharp var dirPath = Path.Combine(destinationDirectory, entry.Key); Directory.CreateDirectory(Path.GetDirectoryName(dirPath + &#34;/&#34;)); ```</p> <p>No `Path.GetFullPath()` normalisation and no bounds check are applied before the `Directory.CreateDirectory` call. Two .NET `Path.Combine` behaviours make this exploitable:</p> <p>- **Relative traversal**: `Path.Combine(&#34;/safe/extract&#34;, &#34;../../evil&#34;)` → the OS resolves `..` segments on the raw path, placing the directory outside the extraction root. - **Absolute path override**: `Path.Combine(&#34;/safe/extract&#34;, &#34;/tmp/evil&#34;)` → returns `&#34;/tmp/evil&#34;` — the base is discarded entirely for rooted paths.</p> <p>File entries are **not** directly affected — they route through `ExtractionMethods.WriteEntryToDirectory` which applies the correct guard (`GetFullPath` + `StartsWith`, see `ExtractionMethods.cs:54–65`). The directory-entry branch is a separate fast-path that was added witho…</p> https://vulnerability.circl.lu/vuln/ghsa-6c8g-7p36-r338