- Yama var
- Son 7 gün
- CWE-22
- CWE-23
CVE-2026-61725
sevenz-rust2: unchecked 7z entry paths permit traversal and absolute-path file overwrites
- Yayımlandı
- Güncellendi
- 31 Eki 2026
- Açık yaşı
- 0 gün
- Kaydı açan
- GitHub_M
Özet
Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.
sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In src/util/decompress.rs, decompress_impl computes each destination with dest.join(entry.name()) without normalizing the archive's UTF-16 entry name or verifying containment, and default_entry_extract_fn writes to it with File::create. Parent-directory components escape the extraction root, and an absolute entry path makes the join discard the destination entirely. The convenience entry points decompress, decompress_file, decompress_with_password, and decompress_file_with_password all use this default path. Overwriting writable configuration, startup, cron, or build files can lead to code execution or persistence. The archive bytes are the attacker-controlled trust boundary, including for applications that automatically unpack uploaded or otherwise untrusted archives. This issue is fixed in version 0.21.1.
Etkilenen sürümler1 yazılım
| Yazılım | Etkilenen | Düzeltildiği sürüm |
|---|---|---|
| hasenbanck sevenz-rust2 | < 0.21.1 | 0.21.1 |
Kaynaklar4 kaynak
Kayıt geçmişi
- Yayımlandı