CVE-2021-32840
Path Traversal in SharpZipLib
SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Prior to version 1.3.3, a TAR file entry ../evil.txt may be extracted in the parent directory of destFolder. This leads to arbitrary file write that may lead to code execution. The vulnerability was patched in version 1.3.3.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Path Traversal in SharpZipLib
SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Prior to version 1.3.3, a TAR file entry ../evil.txt may be extracted in the parent directory of destFolder. This leads to arbitrary file write that may lead to code execution. The vulnerability was patched in version 1.3.3.
- Record
CVE-2021-32840- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2022-1085
SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Prior to version 1.3.3, a TAR file entry ../evil.txt may be extracted in the parent directory of destFolder. This leads to arbitrary file write that may lead to code execution. The vulnerability was patched in version 1.3.3.
- Record
EUVD-2022-1085- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-m22m-h4rf-pwq3
Path Traversal in SharpZipLib
SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Prior to version 1.3.3, a TAR file entry ../evil.txt may be extracted in the parent directory of destFolder. This leads to arbitrary file write that may lead to code execution. The vulnerability was patched in version 1.3.3.
- Record
GHSA-m22m-h4rf-pwq3- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Prior to version 1.3.3, a TAR file entry ../evil.txt may be extracted in the parent directory of destFolder. This leads to arbitrary file write that may lead to code execution. The vulnerability was patched in version 1.3.3.
- Record
CVE-2021-32840- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Prior to version 1.3.3, a TAR file entry ../evil.txt may be extracted in the parent directory of destFolder. This leads to arbitrary file write that may lead to code execution. The vulnerability was patched in version 1.3.3.
- Record
CVE-2021-32840- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-m22m-h4rf-pwq3
Path Traversal in SharpZipLib
SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Prior to version 1.3.3, a TAR file entry ../evil.txt may be extracted in the parent directory of destFolder. This leads to arbitrary file write that may lead to code execution. The vulnerability was patched in version 1.3.3.
- Record
GHSA-m22m-h4rf-pwq3- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-32840
SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Prior to version 1.3.3, a TAR file entry ../evil.txt may be extracted in the parent directory of destFolder. This leads to arbitrary file write that may lead to code execution. The vulnerability was patched in version 1.3.3.
- Record
UBUNTU-CVE-2021-32840- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
SharpZipLibNuGet |
before 1.3.3 | 1.3.3 |
SharpZipLibNuGet |
before 1.3.3, plus listed versions 0.86.01.0.01.0.0-alpha11.0.0-alpha21.0.0-rc1 Show 6 moreShow less1.0.0-rc21.1.01.2.01.3.01.3.11.3.2 |
1.3.3 |
monoUbuntu:22.04:LTS |
All versions, plus listed versions 6.8.0.105+dfsg-3.2 |
None known |
monoUbuntu:24.04:LTS |
All versions, plus listed versions 6.8.0.105+dfsg-3.46.8.0.105+dfsg-3.5ubuntu16.8.0.105+dfsg-3.6ubuntu16.8.0.105+dfsg-3.6ubuntu2 |
None known |
monoUbuntu:25.10 |
All versions, plus listed versions 6.12.0.199+dfsg-36.12.0.199+dfsg-6 |
None known |
monoUbuntu:26.10 |
All versions, plus listed versions 6.14.1+ds2-26.14.1+ds2-3 |
None known |
monoUbuntu:26.04:LTS |
All versions, plus listed versions 6.12.0.199+dfsg-66.14.1+ds2-16.14.1+ds2-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-32840 is a high vulnerability (CVSS 7.3) in Icsharpcode Sharpziplib, published January 26, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.91%, the 79th percentile. Fixed in SharpZipLib 1.3.3.
References
securitylab.github.com/advisories/GHSL-2021-125-sharpziplib
github.com/icsharpcode/SharpZipLib/releases/tag/v1.3.3
nvd.nist.gov/vuln/detail/CVE-2021-32840
ubuntu.com/security/CVE-2021-32840
cve.org/CVERecord?id=CVE-2021-32840