Zip Slip

Also Known As

TL;DR

Explanation

Zip Slip exploits archive libraries that extract file entries without stripping path components. A maliciously crafted zip containing an entry named ../../etc/cron.d/evil or ../../var/www/html/shell.php will write outside the intended extraction directory. PHP's ZipArchive does not automatically prevent this — validate every entry name with realpath() or basename() before extraction and confirm the resolved path starts with the intended target directory. The vulnerability also affects .tar.gz, .tar.bz2, and other archive formats.

Common Misconception

Why It Matters

Common Mistakes

• Using ZipArchive::extractTo() without validating each entry's path against the target directory.
• Checking only the filename component with basename() but not the full path of each zip entry.
• Not verifying that realpath() of the extracted file's destination is within the target directory.
• Trusting zip files from authenticated users — a compromised account can upload malicious archives.

Avoid When

• Never extract archives directly to a web-accessible directory without path validation.
• Do not trust filenames inside zip/tar archives — they are attacker-controlled.

When To Use

• Always validate extracted file paths against the intended destination directory using realpath().
• Use str_starts_with(realpath($extractPath), $destinationDir) to reject any path that escapes the target folder.

Code Examples

$zip->extractTo('/uploads/'); // entries like ../../shell.php escape the dir

foreach ($entries as $entry) {
  $dest = realpath('/uploads/') . '/' . basename($entry);
  if (strpos(realpath(dirname($dest)), realpath('/uploads/')) !== 0) throw new Exception('Zip Slip');
}

References

• ↗ https://snyk.io/research/zip-slip-vulnerability
• ↗ https://owasp.org/www-community/vulnerabilities/Path_Traversal

Tags

Related Terms