ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target

ZipStreamReader::extract applies Unix permissions through extracted symlinks without validating the symlink target stays within the destination For further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-4684-h2q9-2vcp...

zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory

In zip 9.0.0-pre2, ZipArchive::extract creates a symbolic link from an archive entry after validating only the output entry path. The link target bytes are passed directly to the platform symlink API, so a malicious archive can create an entry inside the destination that resolves to an...

Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation

The zip crate preserves privileged Unix permission bits SUID, SGID, and sticky bits from ZIP externalattributes during extraction, instead of masking them to safe permission bits. If a privileged process for example, root in an installer, CI/CD pipeline, or container build extracts an...