Skip to main content

18. A Quick Guide to Zip Slip Vulnerabilities

Zip Slip is a vulnerability that enables arbitrary file writes when ../ paths are not properly removed during archive extraction. If a web upload feature extracts ZIP files, an entry such as ../../../../var/www/html/shell.jsp can overwrite files on the server.

Simple Attack Flow​

  • Include an escaping path in the archive
  • The server extracts it unchanged with a function such as zip.extract()
  • Overwrite the web root or configuration files, leading to RCE

Practical Checks​

  • Whether entry paths inside the ZIP are normalized
  • Whether the extraction library provides automatic protection
  • Whether archives are extracted into a privileged directory

Defensive Measures​

  • Validate extraction paths using realpath
  • Filter paths with an allowlist
  • Extract archives inside a sandboxed or isolated directory

Zip Slip appears frequently in CTFs and is still found in production upload features. Never forget that archive extraction is a form of input handling.