---
id: CVE-2026-61725
title: >-
  sevenz-rust2: unchecked 7z entry paths permit traversal and absolute-path file
  overwrites
summary: >-
  sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. Prior to
  0.21.1, extracting an attacker-supplied 7z archive can write or overwrite
  files outside the destination directory. In `src/util/decompress.rs`,
  `decompress_impl` co…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-22
  - CWE-23
vendor: hasenbanck
product: sevenz-rust2
affected:
  - sevenz-rust2 < 0.21.1
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T14:45:51.198089Z'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T14:46:18.025Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-61725'
references:
  - url: >-
      https://github.com/hasenbanck/sevenz-rust2/security/advisories/GHSA-qh76-45cr-8xrc
    label: >-
      https://github.com/hasenbanck/sevenz-rust2/security/advisories/GHSA-qh76-45cr-8xrc
  - url: >-
      https://github.com/hasenbanck/sevenz-rust2/commit/ef760b61f3535ac8b93006212aef41bfebc237eb
    label: >-
      https://github.com/hasenbanck/sevenz-rust2/commit/ef760b61f3535ac8b93006212aef41bfebc237eb
tags:
  - cve.org
  - exploit-available
epss: 0.00138
epssPercentile: 0.03193
ingestedAt: '2026-11-05T19:30:42.673Z'
---

## Overview

sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In `src/util/decompress.rs`, `decompress_impl` computes each destination with `dest.join(entry.name())` without normalizing the archive's UTF-16 entry name or verifying containment, and `default_entry_extract_fn` writes to it with `File::create`. Parent-directory components escape the extraction root, and an absolute entry path makes the join discard the destination entirely. The convenience entry points `decompress`, `decompress_file`, `decompress_with_password`, and `decompress_file_with_password` all use this default path. Overwriting writable configuration, startup, cron, or build files can lead to code execution or persistence. The archive bytes are the attacker-controlled trust boundary, including for applications that automatically unpack uploaded or otherwise untrusted archives. This issue is fixed in version 0.21.1.

## Affected

- `sevenz-rust2 < 0.21.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.