A vulnerability in eazip versions 0.2.5 and 0.2.6 allows crafted archives to create symlinks that escape the intended extraction directory on Windows. This occurs because the symlink target validation mistakenly checks the symlink name instead of the target, allowing backslash characters in targets to bypass validation. This can lead to arbitrary filesystem writes outside the extraction directory. The issue was fixed in version 0.2.7.