Credit where it is due — the Issue was discovered & reported by Harry Sintonen <[email protected]>
________________________________ From: Paul Marquess <[email protected]> Sent: 07 August 2026 14:53 To: Debian Bug Tracking System <[email protected]> Subject: Bug#1143866: zip: Command injection issue with zip Package: zip Version: 3.0-15ubuntu3 Severity: normal Tags: patch I'm with the upstream Info-ZIP team. We've has a command injection issue reported against zip that we've been able to reproduce with the latest Debian sources. Attached patch is the proposed fix. Ping me if you need more details on reproduction steps
