What is GHSA-7378-6268-4278?

GHSA-7378-6268-4278 is a security advisory published by GitHub Security Advisories with Medium severity. DotNetZip Zip-Slip Vulnerability

Which CVE IDs does GHSA-7378-6268-4278 cover?

GHSA-7378-6268-4278 covers the following CVE IDs: CVE-2018-1002205. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7378-6268-4278?

GHSA-7378-6268-4278 has a CVSS v3 base score of 5.5, published by GitHub Security Advisories.

Which products are affected by GHSA-7378-6268-4278?

GHSA-7378-6268-4278 affects 1 product, including: nuget/DotNetZip:\u003c 1.11.0.

GHSA-7378-6268-4278MediumCVSS 5.5

DotNetZip Zip-Slip Vulnerability

Vendor

GitHub Security Advisories

Published

October 16, 2018

Last Modified

May 6, 2025

🔗 CVE IDs covered (1)

CVE-2018-1002205 →

📋 Description

DotNetZip.Semvered before 1.11.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

🎯 Affected products1

nuget/DotNetZip:< 1.11.0

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2018-1002205
https://github.com/haf/DotNetZip.Semverd/pull/121
https://github.com/haf/DotNetZip.Semverd/commit/55d2c13c0cc64654e18fcdd0038fdb3d7458e366
https://github.com/snyk/zip-slip-vulnerability
https://snyk.io/research/zip-slip-vulnerability
https://snyk.io/vuln/SNYK-DOTNET-DOTNETZIP-60245
https://github.com/advisories/GHSA-7378-6268-4278