CVE-2020-36560: go-unzip vulnerable to Path Traversal

The vulnerability stems from the Extract method in unzip.go which handled zip entry names without adequate path validation. The GitHub patch adds a critical path sanitization check (strings.HasPrefix) to this exact function, confirming it was the vulnerable point. The CVE description and Go vulnerability report (GO-2020-0034) explicitly reference this function as the affected component. The pre-patch code joined user-controlled filenames with the target directory without verifying if the resulting path remained within the designated directory boundary.