sevenz-rust2 Path Traversal and Arbitrary File Overwrite Vulnerability (CVE-2026-61725)
Executive & SecOps Summary
SECOPS ASSESSMENTRust applications utilizing sevenz-rust2 library versions prior to 0.21.1.
Extraction of a malicious 7z archive can lead to writing or overwriting files outside the intended directory, potentially resulting in Remote Code Execution (RCE).
Immediately upgrade sevenz-rust2 dependency to version 0.21.1 or later.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUNDThe primary remediation is to update the crate to a fixed version.
- Update Dependency:
Modify your Cargo.toml or run the following command:
cargo update -p sevenz-rust2- Manual Validation (If update is not possible):
Implement a check to ensure that the archive entry names do not contain traversal sequences or absolute paths before passing them to the decompression function.
// Example: Path validation
let path = std::path::Path::new(entry.name());
if path.is_absolute() || path.components().any(|c| matches!(c, std::path::Component::ParentDir)) {
return Err("Malicious path detected");
}Scan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
The vulnerability resides in the decompress_impl function within src/util/decompress.rs. The library computes the destination path using dest.join(entry.name()) without normalizing the UTF-16 entry names or verifying if the resulting path remains within the target directory. In Rust, Path::join allows parent-directory components (..) to escape the root, and if an entry name is an absolute path, it discards the base destination entirely. This 'ZipSlip' style flaw enables an attacker to overwrite sensitive files such as configuration files, startup scripts, or build artifacts, leading to persistent access or arbitrary code execution.
Official Vendor Advisories & References
sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In `src/util/decompress.rs`, `decompress_impl` computes each destination with `dest.join(entry.name())` without normalizing the archive's UTF-16 entry name or verifying containment, and `default_entry_extract_fn` writes to it with `File::create`. Parent-directory components escape the extraction root, and an absolute entry path makes the join discard the destination entirely. The convenience entry points `decompress`, `decompress_file`, `decompress_with_password`, and `decompress_file_with_password` all use this default path. Overwriting writable configuration, startup, cron, or build files can lead to code execution or persistence. The archive bytes are the attacker-controlled trust boundary, including for applications that automatically unpack uploaded or otherwise untrusted archives. This issue is fixed in version 0.21.1.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.