Cybersecurity glossary
What is Zip Slip?
Learn what Zip Slip is, how archive entries with ../ overwrite files outside the extract directory, real-world impact, and how to safely extract zip, tar, and similar archives.
Definition
Zip Slip is an archive extraction vulnerability in which malicious entries use path traversal sequences (such as ../) in their filenames so that, when extracted, files are written outside the intended directory—often overwriting application code, configuration, or system files.
Why Zip Slip is critical
Archives are treated as boring plumbing—backup imports, plugin installs, “upload a zip of assets.” Extractors often concatenate the destination directory with each entry name and write blindly. Zip Slip turns that into path traversal: ../ sequences escape the sandbox folder and overwrite whatever the process can touch.
It commonly follows a file upload vulnerability or intentional malicious file upload. Distinct from zip bomb / decompression bomb DoS, Zip Slip is about where bytes land. Closely related trust issues include path confusion and unsafe tool flags akin to argument injection.
How Zip Slip extraction fails
Craft hostile entry names
Archive members use ../ chains or absolute paths aimed at binaries or configs.
Deliver the archive
Upload, CI artifact, email import, or plugin package reaches a vulnerable extractor.
Extractor trusts the path
Code joins destDir + entryName without canonicalization or containment checks.
Overwrite outside the sandbox
Application files or system paths are replaced; next execution runs attacker content.
Where Zip Slip shows up
App import features
Theme packs, bulk document zips, and migration uploads extracted on the server.
Build and CI pipelines
Unchecked unzip of third-party artifacts into workspace directories.
Plugin / extension installs
Marketplace packages expanded over application roots.
Custom extract loops
Homegrown zip/tar handlers that skip library safety helpers.
Prevention that works
| Control | Notes |
|---|---|
| Containment check | Canonicalize entry path; require it stays under the destination root |
| Reject absolute paths | Drop entries starting with / or drive letters on Windows |
| Reject .. segments | Fail closed on parent-directory references in entry names |
| Use maintained libraries | Prefer extract APIs with built-in slip protections; keep them updated |
| Least-privilege extractors | Run unzip workers with write access only to a dedicated scratch volume |
| Post-extract audit | Verify resulting file tree matches expected depth and allowlisted names |
- Search code for zip/tar extract loops that concatenate paths without validation.
- Add unit tests with entries like ../../evil.txt and absolute paths; expect rejection.
- Extract only to empty, dedicated directories—not over live application roots.
- Run extractors as locked-down users without permission to overwrite binaries.
- Distinguish Zip Slip tests from [zip bomb](/glossary/zip-bomb) ratio limits—implement both.
- Review plugin and CI unzip steps with the same rigor as user upload extractors.
- Monitor for unexpected file writes outside staging directories during imports.
- If overwrite RCE is proven, rotate secrets and redeploy from known-good artifacts.
The practical takeaway
Zip Slip is path traversal smuggled inside archive entry names. Before extracting, resolve and contain every path; never trust ../ from a zip you did not build.
If your product unzips user content, assume the archive wants to write next to your application—and prove your extractor refuses.
Related security terms
File Upload Vulnerability
Upload flaws that often precede unsafe archive extraction.
Zip Bomb
Compression ratio attacks that exhaust resources rather than traverse paths.
Decompression Bomb
Related resource-exhaustion pattern during inflate/expand.
Argument Injection
Another class where untrusted strings alter command or tool behavior.
Frequently asked questions
What is Zip Slip in simple terms?
A zip (or tar) file contains entries named like ../../app.js. A vulnerable extractor writes those files above the target folder and can overwrite critical files.
Is Zip Slip only about .zip files?
No. The same pattern affects tar, war, jar, apk, 7z, and other archives when extractors trust entry paths.
How is Zip Slip different from a zip bomb?
A [zip bomb](/glossary/zip-bomb) aims at resource exhaustion via huge expansion ratios. Zip Slip aims at writing outside the extract directory via traversed paths.
What is the usual impact?
Overwrite of executables, templates, or config can yield remote code execution, persistence, or credential theft—especially after a [malicious file upload](/glossary/malicious-file-upload).
How do you prevent Zip Slip?
Resolve each entry to a canonical path and ensure it stays within the destination root; reject absolute paths and .. segments.
Are modern libraries immune?
Many patched versions added checks, but custom extract loops and outdated dependencies remain common. Verify your code path explicitly.
Does allowlisting upload extensions stop Zip Slip?
Not if archives are a permitted type. You must secure extraction itself—see also [unrestricted file upload](/glossary/unrestricted-file-upload) for intake hardening.
References
Explore authoritative guidance and frameworks related to zip slip.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.