While working in WebClient Project cross-zip package, I discovered a Directory Traversal vulnerability that allows unauthorized access to sensitive system files. The issue occurs due to improper handling of file paths in the zipSync() and unzipSync() functions, where user-controlled input can lead to reading or writing files outside the intended directory.
CVE Link
CVE Report