[tsurutanmen]

Summary

Fixes the Zip Slip path traversal in extract() reported as CVE-2026-112302 / GHSA-m3xg-f8vh-5p22 (CWE-22), affecting releases up to 2.3.02.

Problem

ArchiveZip::extract() built the destination path by concatenating the extraction path with the raw entry name, without validating the entry name. An archive containing entries such as ../escaped.txt or sub/../../escaped2.txt therefore writes files outside the extraction directory, with attacker-controlled contents.

I verified this locally against the current main: extracting a crafted ZIP wrote both files outside the target directory. (extractAll() is not affected, as it delegates to PHP's native ZipArchive::extractTo().)

Fix

• Added BaseArchive::safeExtractPath(), which lexically resolves an entry name against the destination directory and throws an exception if the entry would escape it. Entries containing .. that stay inside the destination (e.g. sub/../file.txt) still extract as before.
• ArchiveZip::extract(), ArchivePhar::extract() and ArchiveRar::extract() now resolve their write paths through this helper, since they share the same sink pattern.

Tests

• New tests/ArchiveZipSlipTest.php regression tests: traversal entries are rejected and nothing is written outside the destination. These tests fail on the unfixed code and pass with this change.
• Existing Pest suite: no new failures (the failing set is identical before and after the change; the remaining errors are pre-existing environment issues around p7zip/imagick in my local setup). All ZIP-related tests pass.
• phpstan (project configuration, level 5): no errors.