CVE-2026-44788: SharpCompress path traversal in WriteToDirectory

Executive brief

SharpCompress, a popular .NET library for handling various archive formats, is vulnerable to a 'Zip Slip' style directory traversal. An attacker can provide a specially crafted ZIP or TAR archive that, when extracted, creates directories or files outside of the intended folder. This could allow an attacker to overwrite sensitive system files or configuration, potentially leading to unauthorized access or system disruption.

Technical details

A path traversal vulnerability exists in the `IArchive.WriteToDirectory()` method of SharpCompress. The root cause is a lack of path normalization (via `Path.GetFullPath`) and bounds checking in the directory-entry branch of the extraction logic, which uses `Path.Combine` insecurely. For ZIP archives, this allows arbitrary directory creation. For TAR archives, the vulnerability can be escalated to a full arbitrary file write primitive if the caller implements a `SymbolicLinkHandler`. This occurs because the library does not validate symlink targets, allowing an attacker to create a symlink pointing outside the extraction root and subsequently write a file through that symlink. The issue is fixed in version 0.48.0.

Affected products

• adamhathcock SharpCompress < 0.48.0

Timeline

• 2026-05-06: disclosed
• 2026-05-06: patched
• 2026-05-08: advisory

References

• https://api.github.com/users/svenclaesson
• https://github.com/svenclaesson
• https://api.github.com/users/svenclaesson/gists%7B/gist_id%7D
• https://api.github.com/users/svenclaesson/repos
• https://avatars.githubusercontent.com/u/2105609?v=4
• https://api.github.com/users/svenclaesson/events%7B/privacy%7D