Teknium 3a7907b278 fix(security): prevent zip-slip path traversal in self-update (#3250) ...

Validate each ZIP member's resolved path against the extraction directory
before extracting. A crafted ZIP with paths like ../../etc/passwd would
previously write outside the target directory.

Fixes #3075

Co-authored-by: Hiren <hiren.thakore58@gmail.com>

2026-03-26 13:40:37 -07:00

162 KiB

Raw Blame History

View Raw