ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target

Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation

zip: ZipArchive::extract creates symbolic links whose attacker-controlled targets are outside the destination directory