CVE-2018-1002208

Public exploit available. Not confirmed exploited in the wild yet. Fixed in 1.0.0-rc1.

CVSS 3.15.5Medium EPSS percentile96th9.9% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 2 sources Fix1.0.0-rc1Upgrade to this build

Published 2018-07-25Updated 2024-11-21Sources: CVE.org, NVD, GitHub, CSAF

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

SharpZipLibAffected: < 1.0 RC1Upgrade to: not statedStated by: CVE record
NuGet SharpZipLibAffected: < 1.0.0-rc1Upgrade to: 1.0.0-rc1Stated by: GitHub advisory

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check your applications and NuGet dependencies for SharpZipLib versions older than 1.0.0-rc1.
Update SharpZipLib to 1.0.0-rc1 or later.
Until updated, do not extract ZIP files received from untrusted sources.

dotnet add package SharpZipLib --version 1.0.0-rc1

Vendor advisory Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

SharpZipLib before 1.0 RC1 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

In plain language

Written by AI from the record

SharpZipLib versions before 1.0.0-rc1 can let a malicious ZIP file overwrite files when opened, so small businesses using it should update.

Directory traversal (“Zip Slip”) in SharpZipLib before 1.0.0-rc1 permits arbitrary file writes through ../ paths in ZIP entries during extraction.

If you're affected

Arbitrary file overwrite
Application file tampering
Service disruption
Possible system compromise

What is it

This flaw lets a ZIP file contain instructions to place files outside the folder where it should be unpacked. It is like accepting a delivery addressed to your stockroom, only for the contents to be placed anywhere in the building, including places they should not reach.

Who is affected

This matters to you if you run software that uses SharpZipLib to open or unpack ZIP files. It can affect custom business applications and vendor software that includes this library. The risk exists when the software extracts ZIP files supplied by an untrusted person or system.

How urgent is it

Public proof-of-concept code exists, so an attacker can create a ZIP file designed to overwrite files when your software extracts it. This is an amber issue: schedule the update promptly, especially for systems that accept ZIP uploads or imports; it is not listed in CISA’s known-exploited catalog.

What to do — in detail

Confirm whether your application directly references SharpZipLib, or whether a vendor product bundles it, and identify any ZIP-extraction workflows that process customer uploads, email attachments, imports, or files from connected systems.

Upgrade NuGet/SharpZipLib to 1.0.0-rc1 or a later stable release. Test the upgrade in a staging environment, particularly any archive-import or extraction functionality; moving from an older pre-release or legacy integration may require application compatibility testing.

If patching is delayed, block or quarantine untrusted ZIP files before they reach the affected extraction process, or disable that import/extraction feature temporarily. Review application and host logs for unexpected file writes after archive extraction. CISA has not assigned a KEV remediation due date because this CVE is not in the KEV catalog.

Technical context

CVE-2018-1002208 is CWE-22 directory traversal in SharpZipLib before 1.0.0-rc1. A crafted ZIP entry containing ../ path segments can escape the intended extraction directory and cause arbitrary file writes. CVSS v3.1 is 5.5 (Medium): AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. Two public GitHub PoCs are known; no confirmed in-the-wild exploitation is reported in the findings, and the CVE is not listed in CISA KEV. EPSS is 9.9% (95th percentile) and rising.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

2 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

9.9% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 471 days before any public exploit.

2026-09-20EPSS band changemoderate → lowepss band change
2026-08-10EPSS band change0 → moderateepss band change
2026-03-06Public exploit / PoCsource: other
2024-11-21Patch availablerecord updated
2018-07-25Publishedweakness classified, att&ck mapped

Affected products

sharpziplib projectoss-projectaka sharpziplib
- sharpziplibLibraryOSS Libraries / generic-library
SharpZipLiboss-project
- SharpZipLibLibraryOSS Libraries / generic-library
NuGetpackage-ecosystem
- SharpZipLibOSS Libraries

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Scored 5.5 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability NoneNo availability impact