Test files › Archives › zip-slip-traversal.zip
Sample ZIP file
Archive containing an entry named ../../../../tmp/qa-zip-slip.txt. The payload is a harmless text marker, but the path escapes the extraction directory.
↓ Download zip-slip-traversal.zip| Filename | zip-slip-traversal.zip |
| Format | ZIP |
| Size | 357 bytes (357 bytes) |
| MIME type | application/zip |
| SHA-256 | bf5ee2334900a786100f6b030fa929e1a6101b1075f501ff8d7be41c0b38107e |
What this file catchesExtractors that join the entry name to the destination without normalising and re-checking containment (Zip Slip, CVE-2018-1002200 and dozens of siblings). A correct extractor rejects this entry; a vulnerable one writes outside the target directory.
Download & verify
curl -fsSL -o "zip-slip-traversal.zip" "https://files.hexaqa.com/archive/zip-slip-traversal.zip"
curl -fsSL "https://files.hexaqa.com/archive/zip-slip-traversal.zip" | sha256sum
# expect: bf5ee2334900a786100f6b030fa929e1a6101b1075f501ff8d7be41c0b38107e