AIKIDO-2026-703453

TL;DR

The Android unzip and unzipWithPassword methods extract archives with the bundled zip4j library using its default parameters, which extract symbolic link entries. zip4j does not verify that a symlink's resolved target stays inside the destination directory, so a crafted archive can plant a symbolic link that points outside the extraction root. An attacker who supplies a malicious archive can cause a link to be created outside the intended destination directory, enabling a Zip Slip-style escape and writing or overwriting files outside that directory. The fix extracts entries with symlink extraction disabled so such entries are skipped.