TI-2026-32672 Aliases CVE-2026-44788 GHSA-6c8g-7p36-r338

SharpCompress: Directory traversal via directory entries in WriteToDirectory (zip slip variant)

MEDIUM 62CWE-22Published 2026-05-26 · Updated 2026-05-27

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

SharpCompress is a fully managed C# library to deal with many compression types and formats. In 0.47.4 and earlier, a path traversal vulnerability in IArchive.WriteToDirectory() allows a malicious archive to create directories outside the intended extraction root. For TAR archives, this can be escalated to arbitrary file writes by chaining with a symlink entry, giving a full write primitive on the target filesystem subject to the permissions of the running process.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00313 24th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed SharpCompress (NuGet): 0.48.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
adamhathcock	sharpcompress	up to 0.47.4	—	No fix listed	CNA
—	SharpCompress (NuGet)	before 0.48.0	0.48.0	Patch available	GHSA-6c8g-7p36-r338

sharpcompress Vendoradamhathcock Affected up to 0.47.4 Fixed in — No fix listed CNA
SharpCompress (NuGet) Vendor— Affected before 0.48.0 Fixed in 0.48.0 Patch available GHSA-6c8g-7p36-r338

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:adamhathcock:sharpcompress::::::::	up to 0.47.4	Vulnerable	adamhathcock

cpe:2.3:a:adamhathcock:sharpcompress:*:*:*:*:*:*:*:* Versions up to 0.47.4 Vulnerable ·adamhathcock

Remediation

Fix · GHSA-6c8g-7p36-r338 SharpCompress (NuGet) Fixed in 0.48.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-44788
2026-10-03 Alias added: GHSA-6c8g-7p36-r338

References

Exploit 1

https://github.com/adamhathcock/sharpcompress/security/advisories/GHSA-6c8g-7p36-r338

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-44788

Other 2

TI-2018-16138 Path traversal in SharpCompress CVSS 3.0MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences