CVE-2026-61725

Name of the Vulnerable Software and Affected Versions sevenz-rust2 versions prior to 0.21.1

Description Extracting a malicious 7z archive allows writing or overwriting files outside the intended destination directory. In src/util/decompress.rs, the decompress impl function calculates the destination using dest.join(entry.name()) without normalizing the UTF-16 entry name or verifying if the path remains within the root. Consequently, parent-directory components can escape the extraction root, and absolute paths can cause the destination to be discarded entirely. The default entry extract fn function then writes to these paths using File::create. This behavior affects the decompress, decompress file, decompress with password, and decompress file with password functions. Overwriting critical files such as configuration, startup, cron, or build files may lead to code execution or persistence.

Recommendations Update sevenz-rust2 to version 0.21.1.