zip: ZipArchive::extract creates symbolic links whose attacker-controlled targets are outside the destination directory

ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target

Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation

Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write