Observed Zip Slip in TAR Archive (..\) Inbound

Tim Peck@timpeck

•updated Nov 11, 2025•0•18

This rule detects the 'Zip Slip' vulnerability pattern within incoming TAR archives. Specifically, it looks for the sequence '|00 00 00 2e 2e 5c|' (which represents '..\') within the file data of a POSIX tar archive. This pattern indicates an attempt to extract files outside of the intended directory, potentially leading to directory traversal and arbitrary file overwrite.