Cab-Slip path traversal is a file extraction flaw where archive filenames escape the intended destination directory. Instead of staying inside a temporary folder, extracted files can be written to arbitrary paths on the server. In a privileged service context, that can overwrite binaries and create a route to remote code execution.
Expanded Definition
Cab-Slip path traversal is a file handling weakness in archive extraction logic, where crafted filenames use path components such as ../ or absolute path markers to write outside the intended extraction directory. The risk is not the archive format itself, but the way the application normalises, validates, and applies extracted paths. In security terms, it is a form of unsafe file write that can turn a routine decompression step into a privilege boundary violation.
Definitions vary across vendors and incident reports because the same flaw may appear in ZIP, CAB, TAR, or application-specific packaging workflows. What makes Cab-Slip especially dangerous is context: if the extractor runs with elevated rights, even a single overwritten file can become a persistence or execution path. NIST’s NIST Cybersecurity Framework 2.0 is relevant here because the issue sits at the intersection of secure software handling, system integrity, and operational resilience.
The most common misapplication is treating archive extraction as a low-risk utility task, which occurs when developers trust filenames from untrusted uploads without enforcing path canonicalisation and destination confinement.
Examples and Use Cases
Implementing archive extraction rigorously often introduces extra validation overhead, requiring organisations to weigh convenience and compatibility against the cost of stricter file-path controls.
- A web application accepts customer-uploaded ZIP files and unpacks them into a temporary directory without checking for parent-directory references, allowing a crafted entry to place a file in a sensitive application path.
- A privileged update agent extracts vendor-delivered CAB content as root or SYSTEM, and a malicious archive attempts to overwrite an executable, service file, or startup script.
- A CI/CD pipeline processes build artefacts from multiple sources, but extraction logic preserves embedded filenames rather than enforcing a fixed root, creating a supply-chain injection route.
- An internal document management service decompresses attachments for preview generation, and a traversal payload writes into a configuration directory that later changes application behaviour.
- Security teams testing for unsafe file writes often validate whether extraction libraries block symbolic links, absolute paths, and encoded traversal sequences before deployment.
For implementation guidance, platform teams often pair application hardening with secure coding practices from OWASP File Upload Cheat Sheet and canonical path validation patterns documented in broader secure development guidance.
Why It Matters for Security Teams
Cab-Slip path traversal matters because it converts a file-processing feature into a potential integrity break, and integrity issues are often the first step toward full compromise. Security teams need to treat extraction routines as attack surfaces, not helper utilities, especially when applications ingest third-party archives, automated package feeds, or user-generated content. Controls should focus on path normalisation, strict allowlisting of destination roots, safe handling of symbolic links, and running extractors with minimal privilege. When systems handle sensitive data or deploy code automatically, a traversal flaw can also become an identity and access issue if it overwrites auth-related files, credentials, or agent configuration. Guidance from the CWE entry for path traversal and secure software practices is useful, but the operational priority is limiting blast radius before extraction occurs.
Organisations typically encounter the true impact only after a malicious archive or compromised package has already altered a file on disk, at which point Cab-Slip path traversal becomes an urgent containment and recovery problem.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5, NIST SP 800-63 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.DS | Path traversal threatens data and system integrity during file extraction. |
| NIST SP 800-53 Rev 5 | SI-10 | Input validation and handling of untrusted filenames are core to preventing traversal writes. |
| OWASP Non-Human Identity Top 10 | Unsafe file writes can overwrite secrets, tokens, or agent configs tied to non-human identities. | |
| NIST SP 800-63 | File overwrite attacks can undermine identity assurance when auth artifacts are stored on disk. | |
| NIST AI RMF | AI systems that ingest archives need governance for unsafe file handling and supply-chain integrity. |
Assess file ingestion risks in AI pipelines and constrain extraction to trusted, sandboxed locations.
