Vendor
The zt-zip library fails to validate destination boundaries within its fluent Zips API, allowing arbitrary file writes via path traversal sequences in ZIP entry names.