CVE-2023-39137: 
NixOS vulnerability analysis and mitigation

An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing. The vulnerability was discovered in August 2023 and affects the Archive package, a popular Flutter package for handling compressed files (Ostorlab Blog).

The vulnerability occurs because the Archive package only parses the filename from the Local File Header and does not match it against Central Directory Entry filename. This leads to inconsistency with most zip parsers who typically favor Central Directory Entry. Attackers can craft a malicious zip file with different file names in Local File Header and Central Directory Entry, resulting in a file having different filenames before and after extraction. The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 HIGH (Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) (NVD).

The vulnerability allows attackers to spoof filenames in ZIP archives, which can lead to inconsistent filename parsing. This can be exploited to trick users into executing malicious files by making them appear as benign files before extraction (Ostorlab Blog).