CVE-2018-1002206

Public exploit available. Not confirmed exploited in the wild yet. Fixed in 0.21.0.

CVSS 3.05.5Medium EPSS percentile95th9.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 3 sources Fix0.21.0Upgrade to this build

Published 2018-07-25Updated 2026-06-05Sources: CVE.org, NVD, GitHub

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

SharpCompressAffected: ≥ unspecified, < 0.21.0Upgrade to: 0.21.0Stated by: CVE record
NuGet SharpCompressAffected: < 0.21.0Upgrade to: 0.21.0Stated by: GitHub advisory
Adamhathcock SharpcompressAffected: < 0.21.0Upgrade to: 0.21.0Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your software uses SharpCompress and whether it is older than 0.21.0.
Upgrade SharpCompress to version 0.21.0 or later.
Until upgraded, do not extract ZIP files from untrusted sources with affected software.
Review recent ZIP-processing activity for unexpected files outside extraction folders.

nuget install SharpCompress -Version 0.21.0

Vendor advisory Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

SharpCompress before 0.21.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

In plain language

Written by AI from the record

SharpCompress before 0.21.0 can let a malicious ZIP file place files outside the intended folder, so businesses that extract untrusted ZIP files should upgrade.

SharpCompress before 0.21.0 has a Zip Slip directory-traversal flaw (CWE-22) that mishandles ../ paths in ZIP entries, enabling arbitrary file writes during extraction.

If you're affected

Arbitrary file overwrites
Application configuration tampering
Operational disruption
Potential system compromise

What is it

This is a flaw in how SharpCompress unpacks ZIP files. It is like accepting a delivery addressed to your storeroom, but allowing the sender to label boxes so they are placed anywhere in the building instead.

Who is affected

This matters to you if your applications use SharpCompress to unpack ZIP files. It is especially relevant when those ZIP files come from customers, partners, email attachments, downloads, or other untrusted sources. The risk requires someone to process a malicious ZIP file with the affected software.

How urgent is it

Public proof-of-concept code is available, making this a meaningful risk where untrusted ZIP files are processed. Treat this as an amber-priority upgrade: schedule the update promptly and restrict untrusted ZIP extraction until it is complete.

What to do — in detail

Confirm exposure by reviewing application dependencies, deployed binaries, and NuGet package references for SharpCompress versions earlier than 0.21.0. Upgrade every affected deployment to SharpCompress 0.21.0 or later; no separate supported-version branches are identified in the findings. Test ZIP extraction workflows after the upgrade, particularly any integrations that accept uploaded or downloaded archives.

If patching is delayed, block or quarantine untrusted ZIP files and extract only trusted archives in a restricted environment that cannot write to application, configuration, or system directories. CISA has not assigned a KEV remediation due date because this CVE is not listed in the CISA KEV catalog. Monitor application and endpoint records for ZIP extraction followed by unexpected file creation outside the intended extraction directory, especially changes to application configuration or executable files.

Technical context

CVE-2018-1002206 is rated CVSS 3.0 5.5 (Medium): AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. The weakness is CWE-22 directory traversal, commonly called Zip Slip, using ../ path components in ZIP entry names to escape the extraction destination and write arbitrary files. Public GitHub PoCs are known (3), indicating public exploit maturity. CISA KEV does not list this CVE. EPSS predicts a 9.4% likelihood and is rising (95th percentile); this is a prediction, not confirmation of exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS95th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

3 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

9.4% chance of exploitation activity in the next 30 days, which ranks it in the 95th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

A public exploit existed 90 days before the patch.

2026-09-20EPSS band changemoderate → lowepss band change
2026-09-06EPSS band changelow → moderateepss band change
2026-09-05EPSS band changemoderate → 0epss band change
2026-08-31EPSS band change0 → moderateepss band change
2026-08-29EPSS band changemoderate → low
2026-08-28EPSS band changemoderate → 0epss band change

Affected products

SharpCompressoss-projectaka adamhathcock, sharpcompress project
- SharpCompressLibraryOSS Libraries / generic-library
NuGetpackage-ecosystem
- SharpCompressOSS Libraries

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Scored 5.5 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability NoneNo availability impact