Home / Knowledge hub / Zip slip
Knowledge hub
Zip slip
An archive entry with a crafted path that writes files outside the target folder.
What it means
Zip slip is a path flaw in code that unpacks archives such as zip, tar or jar files. Each entry in an archive carries a file name, and that name can contain sequences like ../. If the code joins the name onto the target folder without checking, the file lands somewhere else on the disk.
It is a form of path traversal hidden inside a file you accepted in good faith. Nobody typed a suspicious path into a form. The suspicious path was inside the upload, and the library or your own loop wrote it out exactly as told.
Why it matters
Writing a file to a place of the attacker's choosing is often enough to take over the server. A script dropped into a web folder, a replaced configuration file or a changed scheduled job can all turn a file write into remote code execution.
Features that look harmless carry the risk: importing a backup, uploading a theme, restoring a project, processing a customer's bulk data file. A customer's trust in your import feature then becomes the way into your servers, and the logs show a normal upload.
How it shows up
You meet it wherever your product accepts a compressed bundle and unpacks it on the server: plugin and theme uploads, data imports, document converters, build and deployment tools, and mobile or desktop update packages. It was widely reported in 2018 across many libraries and projects in several languages.
The fix is the same each time. Work out the full destination path, resolve it, and refuse the entry unless it still sits inside the target folder. Also refuse links inside archives that point outward, and keep dependencies current so library fixes reach you. See file upload vulnerabilities for the wider picture.
Questions people ask
Zip slip, answered
What is the difference between zip slip and path traversal?
Path traversal is the general flaw: a path escapes the folder it should stay in. Zip slip is that flaw arriving inside an archive entry name rather than a URL or form field.
The defence is the same check, applied to each entry as it is extracted.
Does it only affect zip files?
No. Zip is the name that stuck, but tar, jar, war, cpio and other formats can carry entry names too. Any extraction code that trusts those names is exposed.
The format matters less than whether the code checks the final path.
Is my library affected?
Many popular archive libraries have had fixes, and some now check paths for you. Check the release notes of the version you use, and do not assume that your own extraction loop is safe just because the library is.
What can an attacker actually do with it?
They can overwrite or create files wherever the app's account has permission to write. That can mean replacing code, configuration or scheduled tasks, which often leads to running commands on the server.
The damage is limited by what the app account may write, so least privilege helps.
How do we test for zip slip?
Build an archive whose entry names contain ../ sequences, upload it to each feature that unpacks files, and look for a file outside the target folder.
Reading the extraction code also shows quickly whether the final path is checked.
Sources
Where this comes from
Related
Terms that sit next to this one
Path traversal
Using a crafted file name to reach files outside the intended folder.
File upload vulnerability
An upload feature that accepts files it should refuse, such as scripts.
Remote code execution
Getting a server to run commands of an attacker's choosing.
Local file inclusion
Making an app read and show a file from its own server that it should not.
Canonicalisation
Reducing input to one standard form before checking it, so tricks cannot slip by.
What is inside the file you unpack?
Upload and import features are in scope for us. In white-box mode we read the extraction code while testing the running app, so a finding can point to the file and line. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.