Question 1

What is Zip Slip?

Accepted Answer

Zip Slip is a directory-traversal vulnerability in archive extraction. If an unzip routine joins each entry's name onto the extraction directory without canonicalizing the result, an entry named ../../../../etc/cron.d/x writes outside that directory — anywhere the process can — because the ../ sequences walk up the tree.

Question 2

Why is it dangerous?

Accepted Answer

Writing arbitrary files as the server process often leads to remote code execution: dropping a job into /etc/cron.d, overwriting ~/.ssh/authorized_keys for persistent access, or planting a web shell in the web root. A single crafted archive processed by a vulnerable extractor is enough.

Question 3

How do I prevent Zip Slip?

Accepted Answer

Resolve each entry to an absolute path and verify it starts with the extraction directory plus a separator before writing; reject entries that are absolute or contain ../ segments. Extract as an unprivileged user into an isolated directory or sandbox so even a bypass can't reach system files.

Zip Slip

Challenges

Frequently Asked Questions