CVE-2023-39135: 
Swift vulnerability analysis and mitigation

An issue in Zip Swift v2.1.2 allows attackers to execute a path traversal attack via a crafted zip entry. The vulnerability was discovered and reported on July 24, 2023, affecting the Zip library for Swift programming language (Ostorlab Blog, GitHub Issue).

The vulnerability exists in the unzipFile function where the package does not validate paths coming from zip entries. The pathString from the zip entry is directly appended to the destination directory without any sanitization, allowing for path traversal attacks. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

This vulnerability could allow attackers to write files outside the intended extraction directory, potentially overwriting sensitive user data. In some cases, this could lead to code execution if an attacker manages to overwrite application files (Ostorlab Blog).

Users should upgrade to a patched version of the Zip library. The vulnerability is similar to the previously known Zip Slip vulnerability, and proper path validation should be implemented to ensure extracted files remain within the intended directory (Snyk Research).