nix-nar: Decoder::unpack writes archive entries outside the destination directory (path traversal)

zip: ZipArchive::extract creates symbolic links whose attacker-controlled targets are outside the destination directory

ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target

Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write

OCI layer symlink escape → arbitrary host write