GHSA-qh76-45cr-8xrc: sevenz-rust2: unchecked 7z entry paths permit traversal and absolute-path file overwrites
sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In src/util/decompress.rs, decompressimpl computes each destination with dest.join(entry.name()) without normalizing the archive's UTF-16 entry name or verifying containment, and defaultentryextractfn writes to it with File::create. Parent-directory components escape the extraction root, and an absolute entry path makes the join discard the destination entirely. The convenience entry points decompress, decompressfile, decompresswithpassword, and decompressfilewithpassword all use this default path. Overwriting writable configuration, startup, cron, or build files can lead to code execution or persistence. The archive bytes are the attacker-controlled trust boundary, including for applications that automatically unpack uploaded or otherwise untrusted archives. This issue is fixed in version 0.21.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
sevenz-rust2to a version that resolves this vulnerability.Fixed in 0.21.1
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using sevenz-rust2 versions before 0.21.1 are exposed when they extract attacker-supplied or otherwise untrusted 7z archives through the default convenience entry points: decompress, decompress_file, decompress_with_password, or decompress_file_with_password. This includes services that automatically unpack uploaded archives.
What does an attacker need to exploit it?
An attacker needs to cause the application to extract a crafted 7z archive. The archive must contain an entry name using parent-directory components or an absolute path, allowing writes outside the intended extraction directory.
Are default extraction paths affected?
Yes. The listed convenience extraction functions use the vulnerable default extraction path, which joins the destination directory with the archive entry name without normalizing it or confirming that the resulting path remains contained within the destination.
What can happen if exploitation succeeds?
An attacker can create or overwrite files outside the extraction directory where the extracting process has write permission. Overwriting configuration, startup, cron, or build files may enable code execution or persistence.
What should be done if upgrading is not immediately possible?
Do not extract untrusted 7z archives using the affected default extraction functions. If extraction must continue, use an extraction approach that normalizes entry paths and rejects absolute paths and paths that escape the chosen destination directory.