CVE-2026-44788 Overview
CVE-2026-44788 is a path traversal vulnerability in SharpCompress, a fully managed C# library for handling multiple compression types and formats. The flaw affects versions 0.47.4 and earlier. The vulnerable IArchive.WriteToDirectory() method fails to validate archive entry paths, allowing a crafted archive to create directories outside the intended extraction root. For TAR archives, attackers can chain this with a symlink entry to obtain an arbitrary file write primitive. The write capability is bound by the permissions of the process performing extraction. The issue is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).
Critical Impact
A malicious archive can write attacker-controlled files anywhere the extracting process has write access, enabling code execution paths through overwriting configuration, startup scripts, or binaries.
Affected Products
- SharpCompress library versions 0.47.4 and earlier
- .NET applications using IArchive.WriteToDirectory() for archive extraction
- Services processing untrusted TAR archives via SharpCompress
Discovery Timeline
- 2026-05-26 - CVE-2026-44788 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-44788
Vulnerability Analysis
The vulnerability resides in the IArchive.WriteToDirectory() extension method provided by SharpCompress. When the library iterates archive entries and writes them to disk, it does not sufficiently sanitize entry paths against the configured extraction root. An entry containing parent directory traversal sequences such as ../ resolves to a location outside the target directory. This permits directory creation at attacker-chosen locations on the host filesystem.
For TAR archives, the attack surface expands. TAR supports symbolic link entries, which SharpCompress materializes during extraction. An attacker stages two entries in a single archive: a symlink pointing outside the extraction root, followed by a regular file entry that writes through that symlink. The combination yields an arbitrary write primitive constrained only by filesystem permissions held by the extracting process. The attack requires user interaction to extract the archive but no authentication.
Root Cause
The root cause is missing canonicalization and containment validation of resolved entry paths before file or directory creation. The library does not verify that each fully resolved destination path remains a descendant of the extraction root. It also processes symlink entries without rejecting links that escape that root.
Attack Vector
An attacker delivers a crafted archive through any channel that feeds untrusted input into a SharpCompress extraction routine. Typical vectors include file upload endpoints, email attachments, package update mechanisms, and CI/CD artifact processors. When the application calls IArchive.WriteToDirectory() on the archive, the malicious entries execute the traversal or symlink-chained write. See the SharpCompress GitHub Security Advisory GHSA-6c8g-7p36-r338 for technical details.
Detection Methods for CVE-2026-44788
Indicators of Compromise
- Files or directories created outside the application's designated extraction directory following archive processing
- Symbolic links present in extracted TAR contents that reference absolute paths or parent directories
- Unexpected modifications to system configuration files, startup scripts, or web roots after archive ingestion
- Application logs showing successful extraction of archives containing entries with ../ sequences
Detection Strategies
- Inspect dependency manifests (packages.config, *.csproj, paket.dependencies) for SharpCompress versions at or below 0.47.4
- Audit code paths that call IArchive.WriteToDirectory() or related extension methods on attacker-controlled archives
- Implement file integrity monitoring on sensitive directories adjacent to archive extraction locations
Monitoring Recommendations
- Log archive extraction operations with source identifier, destination path, and resolved entry paths
- Alert on file creation events outside expected extraction roots originating from .NET processes
- Monitor for symbolic link creation events by applications that handle uploaded archives
How to Mitigate CVE-2026-44788
Immediate Actions Required
- Upgrade SharpCompress to a version newer than 0.47.4 that contains the path traversal and symlink handling fix
- Audit all application code paths invoking IArchive.WriteToDirectory() on untrusted input
- Restrict the filesystem permissions of processes performing archive extraction to the minimum required directories
Patch Information
Review the SharpCompress GitHub Security Advisory GHSA-6c8g-7p36-r338 for the fixed release version and patch commit references. Update package references and rebuild affected applications.
Workarounds
- Validate archive entries before extraction by rejecting any entry whose resolved path is not a descendant of the extraction root
- Reject TAR archives containing symlink or hardlink entries when processing untrusted input
- Extract archives in an isolated, ephemeral directory under a low-privilege user account, then move validated content into place
# Configuration example - update SharpCompress package reference
dotnet add package SharpCompress --version <fixed-version>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
