Zip Slip Vulnerability

What Zip Slip Means in Practice

zip slip is a path traversal flaw in archive extraction, where filenames inside a ZIP or similar archive contain relative paths that escape the intended destination. The danger is not the archive itself, but the extraction logic that trusts attacker-controlled paths.

That makes Zip Slip a file handling problem with security consequences that can range from overwriting application files to planting executable content in a sensitive location. It often appears in update workflows, upload handlers, build tools, and any service that expands archives automatically.

Why Zip Slip Is Dangerous

The core issue is that archive extraction can become an arbitrary file write primitive if the extractor fails to normalise paths and reject traversal sequences such as ../ or absolute paths. Once an attacker can place files where the application did not intend, they may replace configuration, drop web-accessible content, or alter code paths.

That is why Zip Slip can lead to code execution, privilege abuse, or wider compromise even when the initial action looks like a routine file upload or decompression task. The exploitability depends on where the extracted files land and what the surrounding service later does with them.

Where Zip Slip Usually Appears

Zip Slip is most common in software that accepts archives from users or external systems and extracts them without strict path validation. Typical examples include file upload pipelines, backup restore jobs, CI and build systems, importers, and automation that processes third-party packages.

It is closely related to directory traversal, but the attack surface is broader because the malicious path is hidden inside the archive entry name rather than supplied directly to a file API. A secure extractor should treat archive metadata as untrusted input and constrain output to a known directory.

How Organisations Reduce Exposure

Prevention starts with secure extraction behaviour: canonicalise paths, reject traversal and absolute paths, and ensure extracted files stay inside the intended directory. Safe archive handling also means limiting what file types are accepted, isolating extraction locations, and avoiding automated trust in archive contents.

For teams hardening upload and extraction flows, the relevant controls are documented in the Path Traversal Guide and the File Upload Security Guide. Those practices are most effective when paired with secure-by-default handling that does not depend on developers remembering to sanitise every filename manually.

Risk and Threat Considerations

Zip Slip is dangerous because it turns archive extraction into a trust boundary failure. If the target process runs with enough permission, a malicious archive can overwrite application files, stage a web shell, poison configuration, or alter scripts that execute later.

Failure mechanism: The extractor accepts archive entry names as-is, fails to resolve them against a fixed root, and writes files outside the intended extraction directory.

Impact: Attackers may gain arbitrary file write, persistence through planted files, code execution, or privilege escalation if the written location is security-sensitive.

Practitioner Guidance

What to watch for: Treat any feature that extracts user-controlled archives as a security-sensitive workflow, especially when it runs on servers, build agents, or automation with elevated file permissions. Review whether the code enforces a fixed extraction root and whether it rejects archive entries that resolve outside that root.

Practitioner note: When extraction cannot be fully trusted, isolate it in a constrained environment and verify the post-extraction filesystem state before downstream processing. The best time to stop Zip Slip is before the archive is expanded, not after a suspicious file has already landed.

Related resources from NHI Mgmt Group

• What are the signs that a zip slip style vulnerability is present in a web application?
• How should security teams prevent Zip Slip vulnerabilities in archive import features?
• Why do zip slip vulnerabilities create such serious risk in application delivery pipelines?
• What happens when a zip slip issue is caught in a pull request before merge?