SharpCompress is a fully managed C# library to deal with many compression types and formats. In 0.47.4 and earlier, a path traversal vulnerability in IArchive.WriteToDirectory() allows a malicious archive to create directories outside the intended extraction root. For TAR archives, this can be escalated to arbitrary file writes by chaining with a symlink entry, giving a full write primitive on the target filesystem subject to the permissions of the running process.
References
| Link | Resource |
|---|---|
| https://github.com/adamhathcock/sharpcompress/security/advisories/GHSA-6c8g-7p36-r338 | Exploit Mitigation Vendor Advisory |
| https://github.com/adamhathcock/sharpcompress/security/advisories/GHSA-6c8g-7p36-r338 | Exploit Mitigation Vendor Advisory |
Configurations
History
05 Jun 2026, 18:10
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:adamhathcock:sharpcompress:*:*:*:*:*:*:*:* | |
| First Time |
Adamhathcock sharpcompress
Adamhathcock |
03 Jun 2026, 02:02
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:sharpcompress_project:sharpcompress:*:*:*:*:*:*:*:* | |
| References | () https://github.com/adamhathcock/sharpcompress/security/advisories/GHSA-6c8g-7p36-r338 - Exploit, Mitigation, Vendor Advisory | |
| First Time |
Sharpcompress Project
Sharpcompress Project sharpcompress |
27 May 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/adamhathcock/sharpcompress/security/advisories/GHSA-6c8g-7p36-r338 - |
26 May 2026, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-26 22:16
Updated : 2026-06-05 18:10
NVD link : CVE-2026-44788
Mitre link : CVE-2026-44788
CVE.ORG link : CVE-2026-44788
JSON object : View
Products Affected
adamhathcock
- sharpcompress
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')