SharpCompress before 0.21.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction.
CVSS 3.0MEDIUM 5.5·Local·No auth·User interaction·EPSS 0.09332·Published 2018-07-25·Fixed in 0.21.0CWE-22