AIKIDO-2026-130799

TL;DR

The default decompress(input, output) API extracts symlink and hardlink entries by resolving each target lexically against the output directory, without a final check against where the entry actually lands on disk. A crafted archive with a chain of symlink entries passes each lexical containment check, but the kernel follows the planted symlinks so a later entry resolves outside output, letting it write or read files outside the intended extraction directory. Overwriting startup scripts or configuration this way can lead to remote code execution. The fix extracts files and directories before symlinks and hardlinks, then resolves each symlink's real target against the output directory and removes it if it escapes.