should prevent zip exctraction to parent dir

[sebastien-mignot]

if the files inside the zip archives have a path like "../../../somewhere/et cetera.", adm will extract the file at this location.
This should not be allowed (or at least not by default), as it poses a security risk.
(during an audit, we managed to take control of our preproduction server by uploading such a .zip on the website : instead of exctracting his file on the user files dir, where they were inactive and blocked, he injected a .php script in the apache directory)

[ArnCo]

I confirm this this behavior. Please let me know when a patch is available.

[jonlinper]

Any solution for this security issue?

[ArnCo]

Let's face it guys, just use another lib, this one is not maintained anymore.

[5saviahv]

It should be fixed for now