CVE-2026-44788: Adamhathcock Sharpcompress

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

SharpCompress is a fully managed C# library to deal with many compression types and formats. In 0.47.4 and earlier, a path traversal vulnerability in IArchive.WriteToDirectory() allows a malicious archive to create directories outside the intended extraction root. For TAR archives, this can be escalated to arbitrary file writes by chaining with a symlink entry, giving a full write primitive on the target filesystem subject to the permissions of the running process.

Affected products

• Adamhathcock Sharpcompress: up to and including 0.47.4

Published 2026-05-26. Last modified 2026-07-24.