File Overwrite Vulnerability in Sevenz-Rust2 by Hasenbanck

CVE-2026-61725

What is CVE-2026-61725?

The Sevenz-Rust2 7z compressor and decompressor prior to version 0.21.1 contains a vulnerability that allows an attacker to exploit the file extraction process. When extracting a maliciously crafted 7z archive, the application can inadvertently write or overwrite files outside of the intended destination directory. This is due to insufficient normalization of the archive's UTF-16 entry names and a failure to verify the containment of these paths. Specifically, the extraction function does not adequately check for parent directory components, which means that attackers can manipulate the extraction path to overwrite sensitive files such as configuration or executable scripts. As a result, this vulnerability poses a risk of unwanted code execution or persistence if exploited through untrusted archives. This issue has been addressed in version 0.21.1.

References