AIKIDO-2025-10211

TL;DR

Affected versions of this package are vulnerable to a directory traversal or zip slip issue during ZIP extraction. When extracting multiple ZIP files, an attacker can bypass the isOutsideTargetFolder check by first extracting a ZIP file containing a symlink to an arbitrary directory (e.g., /tmp/) and then extracting another ZIP file with files or symlinks targeting that location. This allows files to be written outside the intended extraction directory, potentially leading to unauthorized file writes.