CVE-2025-53513: Juju zip slip vulnerability via authenticated endpoint

Any user with a Juju account on a controller can upload a charm to the /charms endpoint. No specific permissions are required - it’s just sufficient for the user to exist in the controller user database. A charm which exploits the zip slip vulnerability may be used to allow such a user to get access to a machine running a unit using the affected charm.