Input validation error in sharpcompress - #VU166173
Published: November 13, 2026
Vulnerability identifier: #VU166173
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to create ZIP archives with duplicate entry names that may obscure archive contents depending on the extracting application.
The vulnerability exists due to incomplete duplicate-key validation in SharpCompress archive-writing APIs when adding entries: synchronous checks examine only the first existing entry, while asynchronous checks do not reflect newly added entries. A remote attacker can supply names such as file1.txt and FILE1.TXT after an unrelated entry synchronously, or directly asynchronously, to bypass duplicate rejection and produce ambiguous archives.
Affected software
sharpcompress
Remediation
Install security update from vendor's website.
sharpcompress - update to 0.50.9