Arbitrary file write via crafted ZIP paths

Path traversal in PF4J 3.9.0 and earlier allows remote attackers to write files outside the plugin directory via a crafted ZIP archive. Unzip.extract joins each ZipEntry name to the destination and writes the resulting path without first verifying that its canonical path remains inside that directory. Exploitation requires a consuming application to pass an attacker-controlled plugin archive to PF4J; files writable by the host process can be replaced, while code execution requires a written file to reach a location the host later loads or executes.