thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Advanced

Zip Slip

A path traversal vulnerability in archive extraction where entries with ../ in their names are written outside the target directory.

Definition

Disclosed widely in 2018, Zip Slip affects ZIP, TAR, JAR and other formats when code does not validate each entry's resolved path. Mitigation: canonicalize each entry path and ensure it stays within the extraction directory, and use libraries that do this by default.

Example

An uploaded archive contains ../../app/config.yml, overwriting the application's configuration on extraction.

Exam tip

It is directory traversal inside archive extraction.

Related terms