ZipSlip

Zip might allow directory traversal when extracting an archive containing relative path (s.a. ../../../../foo/bar) or symlinks (s.a. index.txt -> ../../../index.php).

Reference