UBUNTU-CVE-2026-61725: Medium severity ubuntu/rust-sevenz-rust2 vulnerability
sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In src/util/decompress.rs, decompressimpl computes each destination with dest.join(entry.name()) without normalizing the archive's UTF-16 entry name or verifying containment, and defaultentryextractfn writes to it with File::create. Parent-directory components escape the extraction root, and an absolute entry path makes the join discard the destination entirely. The convenience entry points decompress, decompressfile, decompresswithpassword, and decompressfilewithpassword all use this default path. Overwriting writable configuration, startup, cron, or build files can lead to code execution or persistence. The archive bytes are the attacker-controlled trust boundary, including for applications that automatically unpack uploaded or otherwise untrusted archives. This issue is fixed in version 0.21.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
sevenz-rust2to a version that resolves this vulnerability.Fixed in 0.21.1
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using sevenz-rust2 before 0.21.1 are exposed when they extract attacker-supplied or otherwise untrusted 7z archives through the default convenience entry points: decompress, decompress_file, decompress_with_password, or decompress_file_with_password. This includes services that automatically unpack uploaded archives.
What does an attacker need to exploit the flaw?
An attacker needs a victim to extract a crafted 7z archive. The archive can contain entry names with parent-directory components or absolute paths, causing files to be written outside the intended extraction directory.
Are default extraction calls affected?
Yes. The listed convenience entry points use the vulnerable default extraction path, which creates files using archive entry names without normalizing them or confirming that the resulting path remains within the destination directory.
What can be done if upgrading is not immediately possible?
Do not extract untrusted 7z archives with the affected default extraction path. Where extraction must continue, ensure archive entry paths are normalized and rejected if they are absolute or resolve outside the chosen destination directory before files are created.
How can I determine whether an extraction may have been affected?
Review extraction activity for archives with entry names containing parent-directory components or absolute paths, and inspect writable locations outside the extraction directory for unexpected created or overwritten files. Pay particular attention to configuration, startup, cron, and build files.