{"id":"CVE-2026-61725","aliases":[],"cve":{"records":[{"id":"CVE-2026-61725","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-10T18:59:00.046Z","published":"2026-10-30T22:10:55.526Z","modified":"2026-10-30T22:10:55.526Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-30T22:10:55.526Z"}],"references":[{"url":"https://github.com/hasenbanck/sevenz-rust2/security/advisories/GHSA-qh76-45cr-8xrc","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/hasenbanck/sevenz-rust2/commit/ef760b61f3535ac8b93006212aef41bfebc237eb","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-22","description":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","source":"GitHub_M"},{"id":"CWE-23","description":"CWE-23: Relative Path Traversal","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"title":"sevenz-rust2: unchecked 7z entry paths permit traversal and absolute-path file overwrites","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In `src/util/decompress.rs`, `decompress_impl` computes each destination with `dest.join(entry.name())` without normalizing the archive's UTF-16 entry name or verifying containment, and `default_entry_extract_fn` writes to it with `File::create`. Parent-directory components escape the extraction root, and an absolute entry path makes the join discard the destination entirely. The convenience entry points `decompress`, `decompress_file`, `decompress_with_password`, and `decompress_file_with_password` all use this default path. Overwriting writable configuration, startup, cron, or build files can lead to code execution or persistence. The archive bytes are the attacker-controlled trust boundary, including for applications that automatically unpack uploaded or otherwise untrusted archives. This issue is fixed in version 0.21.1.","score":6.1,"severity":"medium","published":"2026-10-30T22:10:55.526Z","modified":"2026-10-30T22:10:55.526Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"hasenbanck","name":"sevenz-rust2","platforms":[],"versions":[{"version":"< 0.21.1","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-61725"}],"remediation":[],"references":["https://github.com/hasenbanck/sevenz-rust2/security/advisories/GHSA-qh76-45cr-8xrc","https://github.com/hasenbanck/sevenz-rust2/commit/ef760b61f3535ac8b93006212aef41bfebc237eb"],"sources":[{"name":"CVE","id":"CVE-2026-61725","modified":"2026-10-30T22:10:55.526Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-61725"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","score":6.1}],"sourceAffected":[],"observedAt":"2026-10-30T22:48:13.298Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T09:10:30.844Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-30T23:15:36.303Z","attemptedAt":"2026-10-30T23:15:36.303Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T23:15:36.176Z","attemptedAt":"2026-10-30T23:15:36.176Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-10-30T23:15:35.859Z","attemptedAt":"2026-10-30T23:15:35.859Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T23:15:34.848Z","attemptedAt":"2026-10-30T23:15:34.848Z"}],"evidence":[],"aiSummary":{"text":"sevenz-rust2 versions prior to 0.21.1 are vulnerable to path traversal, allowing an attacker to overwrite files outside the destination directory when extracting a malicious 7z archive. The issue occurs due to unchecked 7z entry paths. This can lead to code execution or persistence if writable configuration files are overwritten.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T00:21:11.088Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-61725"}]}}