Directory traversal vulnerability in Avast before 150918-0 allows remote attackers to delete or write to arbitrary files via a crafted entry in a ZIP archive.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-5612
http://www.securitytracker.com/id/1033860