ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target

ZipStreamReader::extract applies Unix permissions through extracted symlinks without validating the symlink target stays within the destination For further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-4684-h2q9-2vcp...

zip 安全漏洞

zip is a zip implementation in Rust open-sourced by zip-rs. A security vulnerability exists in zip versions prior to 1.3.0 through 2.3.0, which stems from an unvalidated symbolic link that could lead to arbitrary file overwriting...