GHSA-M665-V7PM-7GRJ zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

Summary A critical architectural parser differential exists in the zip crate = 9.0.4 between random-access archive readers ZipArchive and streaming readers ZipStreamReader. ZipArchive considers the Central Directory File Header CDFH authoritative and ignores the filename declared in the Local Fil...