sevenz-rust2 is a Rust-native 7z compressor and decompressor.

sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In src/util/decompress.rs, decompressimpl computes each destination with dest.join(entry.name()) without normalizing the archive's UTF-16 entry name or verifying containment, and defaultentryextractfn writes to it with File::create. Parent-directory components escape the extraction root, and an absolute entry path makes the join discard the destination entirely. The convenience entry points decompress, decompressfile, decompresswithpassword, and decompressfilewithpassword all use this default path. Overwriting writable configuration, startup, cron, or build files can lead to code execution or persistence. The archive bytes are the attacker-controlled trust boundary, including for applications that automatically unpack uploaded or otherwise untrusted archives. This issue is fixed in version 0.21.1.

curl https://cve.zerocrew.in/api/cve/CVE-2026-61725