GHSA-HJQX-J4RW-G7XV zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.

Summary - Verified version: zip 9.0.0-pre3 - Affected versions: 7.2.0 and later - Precondition: The attacker knows or can guess the absolute path of the extraction destination The validation applied to symlinks is purely lexical. As a result, an attacker can write arbitrary files outside the...