Path Traversal (Sibling Zip Slip) in grafana-cli bypasses extraction sandbox, allowing arbitrary file overwrite

### What happened? **Summary:** A Path Traversal (Sibling Zip Slip) vulnerability exists in the `grafana-cli` plugin extraction mechanism. This flaw allows a malicious ZIP archive - installed by an administrator - to escape its specific installation directory and overwrite files in neighboring directories (e.g., other installed plugins) or cause a Denial of Service. **Technical Root Cause**: The vulnerability resides in the `extractFiles` function within `pkg/plugins/storage/fs.go`. The current validation logic validates that the destination path starts with `fs.pluginsDir` (the global plugins folder, e.g., `/var/lib/grafana/plugins`). However, it fails to enforce that the file remains within the *specific* plugin directory (`installDir`). If `fs.pluginsDir` is `/var/lib/grafana/plugins` and the ZIP contains an entry `malicious/../victim-plugin/target.file`: 1. `path.Join` resolves it to `/var/lib/grafana/plugins/victim-plugin/target.file`. 2. The check "Starts with `/var/lib/grafana/plugins`" **PASSES** (Logic flaw). 3. The file is written to the `victim-plugin` directory, corrupting the integrity of a completely different plugin. <img width="975" height="541" alt="Image" src="https://github.com/user-attachments/assets/9a53458d-d559-4705-9a2c-118f2e64e426" /> ### What did you expect to happen? The `extractFiles` function should strictly enforce that all extracted files reside within the specific extraction directory of the plugin being installed (`installDir`), not just the global plugins root. A package manager/installer should ensure isolation between installed components. One plugin should not be able to overwrite the files of another plugin. ### Did this work before? Unknown ### How do we reproduce it? ### Scenario A: Arbitrary File Overwrite **Step 1: Payload generation** The following Python script creates a ZIP file containing a directory traversal payload targeting the grafana-clock-panel plugin. ```python import zipfile def create_poc_zip(): print("[+…