Appium: Symlink based Zip Slip in @appium/support ZIP extraction (CVE-2026-103975)

The vulnerability in @appium/support ZIP extraction arises because the extractor only performs a lexical containment check on each entry's name without resolving symbolic links. When a symlink entry is extracted, its target path is taken verbatim from the archive without validation. A subsequent file entry that resolves through this symlink can be written outside the intended extraction directory, bypassing the containment check. This differs from the earlier CVE-2026-30973, which was a plain path traversal via '..' in entry names and was fixed in version 7.0.6. The symlink-based escape remains exploitable in versions up to 7.2.5 and is fixed in 7.2.6.

An attacker who can supply a crafted ZIP archive can cause files to be written outside the intended extraction directory by exploiting symbolic links within the archive. This can lead to arbitrary file overwrite or placement outside the extraction root, potentially resulting in integrity violations or further exploitation depending on the context in which the extraction occurs. The vulnerability does not impact confidentiality or availability directly but has a proven impact on integrity.

A fix is available in @appium/support version 7.2.6 that addresses this symlink-based Zip Slip vulnerability by properly validating symlink targets during extraction. Users should upgrade to version 7.2.6 or later to mitigate this issue. Until then, avoid extracting untrusted ZIP archives with vulnerable versions. The vendor advisory confirms the patch availability and recommends upgrading.