CVE-2026-103975: Appium: Symlink based Zip Slip in @appium/support ZIP extraction

CVE-2026-30973 (GHSA-rfx7-4xw3-gh4m) was a plain path traversal in the entry name. The containment check built an Error object without throwing it, so an entry literally named something like ../evil.txt was written outside the destination. That issue was fixed in @appium/support 7.0.6 by actually rejecting out of bound entry names.

This finding is a different vector that the 7.0.6 fix does not cover. The archive entry names here are completely legitimate (for example pwn and pwn/owned.txt, no .. anywhere), so every name based defense accepts them. The escape happens through a symbolic link. One entry is a symlink whose target points outside the extraction directory, and a later entry is a regular file whose name resolves through that symlink. The name based containment check never inspects the symlink target, and the extractor writes the symlink target verbatim, so the file lands outside the extraction root.

The two issues compared on the same patched version 7.2.5: