Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

zio

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 3.8NuGetPublished

    Zio has SubFileSystem Path Confinement Bypass via Unresolved .. Segment

    GHSA-h39g-6x3c-7fq9

    Affected
    • NuGet zio <= 0.22.1
    Fixed in
    0.22.2· Vendor fix available
    Issue
    SubFileSystem fails to confine operations to its declared sub path when the input path is /../ (or equivalents /../, /..\\). This path passes all validation but resolves to the root of the parent filesystem, allowing directory level operations outside the intended boundary. Affected Component Zio.UPath.ValidateAndNormalize Zio.FileSystems.SubFileSystem UPath.ValidateAndNormalize has a trailing slash optimisation. When the input ends with / or \, and processParts is still false, the function strips the trailing separator and returns immediately before the .. resolution logic runs. The input /../ triggers this path: the trailing / is the last character, processParts has not been set (because .. as the first relative segment after root is specifically exempted), so the function returns /.. with the .. segment unresolved. The resulting UPath with FullName = "/.." is absolute, contains no control characters, and no colon so it passes FileSystem.ValidatePath without rejection. When…

    Recommended action: Upgrade to 0.22.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →