Arbitrary File Read

@tryghost/zip is vulnerable to Arbitrary File Read. The vulnerability exists because the module.exports function of extract.js does not properly restrict symbolic links in uploaded files, which allows an attacker to upload a symlink, leading to arbitrary files read on the operating system.