CVE-2021-32842

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.0.0 and prior to version 1.3.3, a check was added if the destination file is under a destination directory. However, it is not enforced that `_baseDirectory` ends with slash. If the _baseDirectory is not slash terminated like `/home/user/dir` it is possible to create a file with a name thats begins as the destination directory one level up from the directory, i.e. `/home/user/dir.sh`. Because of the file name and destination directory constraints, the arbitrary file creation impact is limited and depends on the use case. Version 1.3.3 fixed this vulnerability.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
icsharpcode	sharpziplib	>= 1.3.3, < 1.3.3; >= 1.0.0, < 1.0.0*

References

https://github.com/icsharpcode/SharpZipLib/releases/tag/v1.3.3Release Notes, Third Party Advisory
https://securitylab.github.com/advisories/GHSL-2021-125-sharpziplib/Exploit, Third Party Advisory
https://github.com/icsharpcode/SharpZipLib/releases/tag/v1.3.3Release Notes, Third Party Advisory
https://securitylab.github.com/advisories/GHSL-2021-125-sharpziplib/Exploit, Third Party Advisory

Timeline

Published: Jan 26, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-328435.5HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, `virtio.c` has CVE-2021-328445.5HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, ` vi_pci_write`CVE-2021-328457.8HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, the implementat CVE-2021-328467.8HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107, function `pci_vtsock_proc_tx` in `vir CVE-2021-328476.5HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior, a malicious guest can trigg CVE-2021-328487.5Octobox is software for managing GitHub notifications. Prior to pull request (PR) 2807, a user of the system can provide a specifically craf CVE-2021-328498.8Gerapy is a distributed crawler management framework. Prior to version 0.9.9, an authenticated user could execute arbitrary commands. This i CVE-2021-32855.3jxbrowser in TI Code Composer Studio IDE 8.x through 10.x before 10.1.1 does not verify X.509 certificates for HTTPS.CVE-2021-328506.1jQuery MiniColors is a color picker built on jQuery. Prior to version 2.3.6, jQuery MiniColors is prone to cross-site scripting when handlin CVE-2021-328516.1Mind-elixir is a free, open source mind map core. Prior to version 0.18.1, mind-elixir is prone to cross-site scripting when handling untrus CVE-2021-328529.0Countly, a product analytics solution, is vulnerable to cross-site scripting prior to version 21.11 of the community edition. The victim mus CVE-2021-328539.6Erxes, an experience operating system (XOS) with a set of plugins, is vulnerable to cross-site scripting in versions 0.22.3 and prior. This