arbitrary_file_write 1

• Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0) (GHSA-hjqx-j4rw-g7xv) Oct 23, 2026