https://github.com/golang/go/issues/44916
archive/zip: can panic when calling Reader.Open · Issue #44916 · golang/go · GitHub
The Reader.Open API, new in Go 1.16, will panic when used on a ZIP archive containing files that start with “../”. This issue is CVE-2021-27919.