AIKIDO-2026-697831

TL;DR

The unzip() helper in the resource management module extracts downloaded model and resource archives with ZipFile.extractall() and does not validate ZIP entry paths for directory traversal sequences. A crafted archive whose entries contain ../ can write files outside the intended extraction directory. When paired with a compromised or man-in-the-middled download server, an attacker can overwrite sensitive files such as shell startup scripts or SSH authorized_keys, leading to potential code execution. The fix validates that every archive member resolves inside the target directory before extraction.