fix

Vendicated · Vendicated · commit 2dcf0d0b17fb · 2026-07-26T16:37:11.000+02:00
diff --git a/src/main/utils/extensions.ts b/src/main/utils/extensions.ts
@@ -50,7 +50,7 @@ async function extract(data: Buffer, outDir: string) {
                 }
 
                 const pathElements = f.split("/");
-                const directories = pathElements.join("/");
+                const directories = pathElements.slice(-1).join("/");
 
                 const dir = ensureSafePath(outDir, directories);
                 if (!dir) throw new Error(`Path traversal detected: "${f}"`);

Original file line number	Diff line number	Diff line change
`@@ -50,7 +50,7 @@ async function extract(data: Buffer, outDir: string) {`
`50`	`50`	`}`
`51`	`51`
`52`	`52`	`const pathElements = f.split("/");`
`53`		`- const directories = pathElements.join("/");`
	`53`	`+ const directories = pathElements.slice(-1).join("/");`
`54`	`54`
`55`	`55`	`const dir = ensureSafePath(outDir, directories);`
`56`	`56`	if (!dir) throw new Error(`Path traversal detected: "${f}"`);