CVE-2024-48510

DotNetZip Directory Traversal vulnerability

9.8 CriticalPublic exploitFix available

Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.02%Up 2.0 points since Nov 14, 2024

What each source reports

NVD Score used 9.8

Record: CVE-2024-48510
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-22
Updated: 2026-11-02

CVE List 9.1

Record: CVE-2024-48510
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-22
Updated: 2026-11-02

EUVDEUVD-2024-3333 9.1

Record: EUVD-2024-3333
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-xhg6-9j5j-w4vf 8.6

DotNetZip Directory Traversal vulnerability

Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component.

Record: GHSA-xhg6-9j5j-w4vf
CVSS 4.0: 8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

OSV 9.1

Record: CVE-2024-48510
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVGHSA-xhg6-9j5j-w4vf 8.6

DotNetZip Directory Traversal vulnerability

Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component.

Record: GHSA-xhg6-9j5j-w4vf
CVSS 4.0: 8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`DotNetZip` NuGet	1.10.1 to 1.16.0	None known
`ProDotNetZip` NuGet	before 1.19.0	1.19.0
`DotNetZip` NuGet	1.10.1 to 1.16.0, plus listed versions 1.11.01.12.01.13.01.13.11.13.2 Show 8 moreShow less 1.13.31.13.41.13.51.13.61.13.71.13.81.14.01.15.0	None known
`ProDotNetZip` NuGet	before 1.19.0, plus listed versions 1.16.01.17.01.18.0	1.19.0

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	havertz2110/CVE-2024-48510-PoC	2026-03-19

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-48510 is a critical vulnerability (CVSS 9.8) in Nuget Dotnetzip, published November 13, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.02%, the 81st percentile. Fixed in ProDotNetZip 1.19.0.