CVE-2021-32841

    Dashboard / Vulnerabilities / CVE-2021-32841

    CVE-2021-32841

    Published: 26 Jan 2022Last Modified: 8 Jul 2026

    Summary:

    Details: SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.3.0 and prior to version 1.3.3, a check was added if the destination file is under destination directory. However, it is not enforced that `destDir` ends with slash. If the `destDir` is not slash terminated like `/home/user/dir` it is possible to create a file with a name thats begins with the destination directory, i.e. `/home/user/dir.sh`. Because of the file name and destination directory constraints, the arbitrary file creation impact is limited and depends on the use case. Version 1.3.3 contains a patch for this vulnerability.

    References: https://github.com/icsharpcode/SharpZipLib/releases/tag/v1.3.3, https://github.com/icsharpcode/SharpZipLib/commit/5c3b293de5d65b108e7f2cd0ea8f81c1b8273f78, https://securitylab.github.com/advisories/GHSL-2021-125-sharpziplib/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 8f7d89201afa13c814f9b3d1813884ffe0ec7025
    Fixed -1b1ab013ce1df02d8f27cf582197759c614d9126

    Affected versions

    v1.3.2
    v1.3.1
    v1.3.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High