Zip Slip

Archive extraction that follows ../ entries outside the intended directory.

Specifications & Metrics

cwe

CWE-23

impact

High

Core Principles & Analysis

• A crafted archive writes files anywhere the extractor's process can reach.
• Named in 2018 after years of vulnerable extraction libraries.
• Fix is canonical-path validation on every extracted entry.