SharpCompress’s IArchive.WriteToDirectory() implementation allows a malicious archive to create directories outside the intended extraction root, a classic path traversal flaw. In the case of TAR archives the flaw can be amplified by chaining a symlink entry to perform arbitrary file writes, giving the running process a write primitive on the target filesystem. This can lead to overwriting critical files or placing malicious payloads when the extraction runs with elevated privileges, thereby granting an attacker unauthorized modification rights to the system.

The vulnerable product is the SharpCompress library from adamhathcock, used in .NET applications. All releases up to and including version 0.47.4 are affected. Any application that references those versions and processes archives via WriteToDirectory() could be compromised.

The CVSS score of 5.9 indicates moderate severity. EPSS is not available, so no concrete exploitation probability can be given, and the flaw is not in CISA’s KEV catalog. The attack vector is likely local or remote depending on whether the application accepts user supplied archives. If the application runs as a privileged user, the chained symlink attack grants a full write primitive, which could be used to compromise the host. The lack of a known public exploit means risk depends on the attack surface provided by each deployment, but the moderate score signals that patching should be prioritized.