CVE-2026-44788: SharpCompress has directory traversal via directory entries in WriteToDirectory (zip slip variant)

May 8, 2026 (updated July 21, 2026)

A path traversal vulnerability in IArchive.WriteToDirectory() allows a malicious archive to create directories outside the intended extraction root. For TAR archives, this can be escalated to arbitrary file writes by chaining with a symlink entry, giving a full write primitive on the target filesystem subject to the permissions of the running process.

References

github.com/adamhathcock/sharpcompress/commit/2021a06626d0555a4d69471386e763ca5f5d5dfb
github.com/adamhathcock/sharpcompress/security/advisories/GHSA-6c8g-7p36-r338
github.com/advisories/GHSA-6c8g-7p36-r338
nvd.nist.gov/vuln/detail/CVE-2026-44788

Code Behaviors & Features

Detect and mitigate CVE-2026-44788 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →