GCVE - cpe:2.3:a:icsharpcode:sharpziplib:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:icsharpcode:sharpziplib:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Icsharpcode (`d39afe30-f4a1-59b3-a33d-a899dc8d2ae2`)
Product	Sharpziplib (`66a33348-dab3-5617-b2d8-ca368d22fdb2`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-32842`	vulnerable	2026-06-08 05:32:08.149168	Path Traversal in SharpZipLib MEDIUM (4) SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.0.0 and prior to version 1.3.3, a check was added if the destination file is under a destination directory. However, it is not enforced that `_baseDirectory` ends with slash. If the _baseDirectory is not slash terminated like `/home/user/dir` it is possible to create a file with a name thats begins as the destination directory one level up from the directory, i.e. `/home/user/dir.sh`. Because of the file name and destination directory constraints, the arbitrary file creation impact is limited and depends on the use case. Version 1.3.3 fixed this vulnerability. Published: 2022-01-26T21:10:10.000Z Updated: 2025-04-22T18:32:19.882Z Open on db.gcve.eu Reference links https://securitylab.github.com/advisories/GHSL-2021-125-sharpziplib/ https://github.com/icsharpcode/SharpZipLib/releases/tag/v1.3.3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-32841`	vulnerable	2026-06-08 05:32:08.148534	Path Traversal in SharpZipLib MEDIUM (4) SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.3.0 and prior to version 1.3.3, a check was added if the destination file is under destination directory. However, it is not enforced that `destDir` ends with slash. If the `destDir` is not slash terminated like `/home/user/dir` it is possible to create a file with a name thats begins with the destination directory, i.e. `/home/user/dir.sh`. Because of the file name and destination directory constraints, the arbitrary file creation impact is limited and depends on the use case. Version 1.3.3 contains a patch for this vulnerability. Published: 2022-01-26T21:10:15.000Z Updated: 2025-04-22T18:28:07.967Z Open on db.gcve.eu Reference links https://securitylab.github.com/advisories/GHSL-2021-125-sharpziplib/ https://github.com/icsharpcode/SharpZipLib/releases/tag/v1.3.3 https://github.com/icsharpcode/SharpZipLib/commit/5c3b293de5d65b108e7f2cd0ea8f81c1b8273f78	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-32840`	vulnerable	2026-06-08 05:32:08.146680	Path Traversal in SharpZipLib HIGH (7.3) SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Prior to version 1.3.3, a TAR file entry `../evil.txt` may be extracted in the parent directory of `destFolder`. This leads to arbitrary file write that may lead to code execution. The vulnerability was patched in version 1.3.3. Published: 2022-01-26T21:05:10.000Z Updated: 2025-04-22T18:32:29.435Z Open on db.gcve.eu Reference links https://securitylab.github.com/advisories/GHSL-2021-125-sharpziplib/ https://github.com/icsharpcode/SharpZipLib/releases/tag/v1.3.3 https://github.com/icsharpcode/SharpZipLib/commit/a0e96de70b5264f4c919b09253b1522bc7a221cc	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.