This repository was archived by the owner on Jan 3, 2024. It is now read-only.
This repository was archived by the owner on Jan 3, 2024. It is now read-only.
zip_slip #42
Description
Unpack() does not verify the entry name when extracting the file. When the compressed file is constructed by extracting the attacker (with “../” in the entry name), it will overwrite the important file outside the specified directory.