CRITICAL9.8

GHSA-xhg6-9j5j-w4vf

DotNetZip Directory Traversal vulnerability

Quick fix

GHSA-xhg6-9j5j-w4vf — ProDotNetZip: upgrade to the fixed version with the command below.

dotnet add package ProDotNetZip --version 1.19.0

Details

Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component.

Are you affected?

Enter the version of the package you're using.

Affected packages

NuGet/DotNetZip

Introduced in: 1.10.1

No fixed version published yet for DotNetZip (nuget). Pin to a known-safe version or switch to an alternative.

NuGet/ProDotNetZip

Introduced in: 0Fixed in: 1.19.0

Fixdotnet add package ProDotNetZip --version 1.19.0

References

https://nvd.nist.gov/vuln/detail/CVE-2024-48510[ADVISORY]
https://github.com/mihula/ProDotNetZip/pull/21[WEB]
https://github.com/mihula/ProDotNetZip/commit/18486ad6d13742a07a6755ef6edf60d7458f1854[WEB]
https://gist.github.com/thomas-chauchefoin-bentley-systems/855218959116f870f08857cce2aec731[WEB]
https://github.com/haf/DotNetZip.Semverd[PACKAGE]
https://github.com/haf/DotNetZip.Semverd/blob/e487179b33a9a0f2631eed5fb04d2c952ea5377a/src/Zip.Shared/ZipEntry.Extract.cs#L1365-L1410[WEB]
https://www.nuget.org/packages/DotNetZip[WEB]