diff --git a/Aaru/Commands/Archive/Extract.cs b/Aaru/Commands/Archive/Extract.cs index 8961ab6f2..22ca56a59 100644 --- a/Aaru/Commands/Archive/Extract.cs +++ b/Aaru/Commands/Archive/Extract.cs @@ -258,6 +258,9 @@ sealed class ArchiveExtractCommand : Command Replace('/', '\\'); } + // Prevent absolute path attack + fileName = fileName.TrimStart('\\').TrimStart('/'); + string outputPath = Path.Combine(outputDir, fileName); string destinationDir = Path.GetDirectoryName(outputPath); if(destinationDir is not null)