Description

A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-04T19:17:29.237Z",
  "pubdate": "2026-09-04T19:17:29.237Z",
  "executiveSummary": "A critical path traversal vulnerability, classified as a Zip Slip, exists within the file upload and archive processing functionality of SonicWall Network Security Manager (NSM) On-Prem.\nThe vulnerability allows an unauthenticated or authenticated attacker, depending on specific endpoint accessibility, to bypass directory restrictions during the extraction of archive files.\nBy leveraging maliciously crafted archive headers containing path traversal sequences (e.g., ../), an attacker can overwrite arbitrary files on the underlying filesystem.\nThe impact of successful exploitation is significant, potentially leading to remote code execution (RCE) if an attacker overwrites sensitive binaries, configuration files, or startup scripts.\nThis vulnerability compromises the integrity and availability of the affected NSM instance and potentially the wider managed network environment.\nThe risk is high given that the product is a security management appliance often placed in sensitive segments of the network infrastructure.",
  "technicalDetails": "The vulnerability originates from the insecure handling of archive file paths during the extraction process within the SonicWall NSM On-Prem appliance.\nSpecifically, the application fails to perform adequate input validation and sanitization on the filenames stored within uploaded archive structures (e.g., .zip, .tar, .jar).\nThe root cause is a lack of path normalization and boundary checking when parsing entries in a compressed archive. When the application extracts these files, it blindly trusts the paths provided within the archive metadata.\nAn attacker can exploit this by crafting an archive containing files with path traversal sequences, such as '../../etc/cron.d/malicious_job' or 'webapps/ROOT/shell.jsp'.\nThe attack flow proceeds as follows: 1) The attacker identifies an endpoint within the NSM platform that accepts archive uploads for processing (such as firmware updates, log bundles, or configuration imports). 2) The attacker crafts a malicious archive containing one or more files with manipulated filenames that escape the target extraction directory. 3) The attacker initiates the upload process via the management interface or relevant API endpoint. 4) The NSM server-side processing engine attempts to extract the archive content. 5) Due to the missing boundary checks, the extraction logic resolves the traversal sequences, causing the file system interface to write the payload to an arbitrary location outside the intended sandbox directory.\nThe post-exploitation impact is severe, as the ability to write files to arbitrary locations on the filesystem allows for the modification of application logic, the injection of webshells into the web server's docroot, or the corruption of system binaries.\nDepending on the user context under which the NSM process operates, this could result in complete system compromise and privilege escalation, as the adversary can effectively plant persistent backdoors that execute with the permissions of the NSM service user."
}