EUVD-2026-39050
GHSA-q6rc-2cgv-63h7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft 7z with chained symlink escape
-
DeliveryDeliver archive to extracting service
-
ExploitVictim calls extractall on archive
-
ExecutionSymlink chain resolves outside destination
-
PersistRegular file written through symlink to sensitive path
-
ImpactTrigger execution via overwritten file (e.g. authorized_keys, cron, site-packages)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Symlink resolution safety
|
| Exploitation Conditions | Requires the victim application to call py7zr.SevenZipFile.extractall() (or equivalent extraction API) on a 7z archive supplied or influenced by the attacker, using py7zr versions 1.1.0 through 1.1.2 on a filesystem that supports symbolic links (Linux, macOS, or Windows with symlink privileges). Exploitation is limited by the need for the host process to actually have write permissions on the ultimate symlink target - impact scales with the privileges of the extracting process - and by UI:R, which here means a user or automated job must initiate extraction of the malicious archive. No authentication against py7zr itself is required; the limiting factor is whether the surrounding application accepts untrusted 7z input. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H (8.0 High) is plausible if you treat the 'attacker' as a remote party supplying a malicious archive and the 'victim' as a user running extractall, but PR:L is debatable - the attacker generally needs no authentication against py7zr itself; rather, the consuming application must be willing to extract attacker-supplied archives, which is a deployment-context condition rather than an authentication requirement. EPSS, KEV, and SSVC data are not provided, so prioritization rests on the published PoC and the breadth of py7zr's user base. Real-world impact is highest in services that automatically extract user-uploaded 7z files (file-sharing portals, malware sandboxes, CI artifact handlers) where UI:R is effectively satisfied by an automated unpack step, and lowest in interactive desktop usage where users rarely extract untrusted archives. The fix is shipped in 1.1.3, which makes patching the practical priority. |
| Exploit ScenarioDerived | An attacker uploads a crafted 7z archive to a service that processes user submissions with py7zr <= 1.1.2 (for example a malware-analysis sandbox, document-conversion service, or CI job that unpacks build artifacts). When the service calls extractall(), the chained symlinks materialize and resolve outside the extraction directory, and a subsequent regular file in the archive is written to a sensitive path such as ~/.ssh/authorized_keys, a cron drop directory, or a Python site-packages file - yielding code execution as the service user. A PoC from the GHSA advisory demonstrates the full chain end-to-end. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 19, 2026
Arbitrary file write in py7zr versions 1.1.0 through 1.1.2 allows attackers to escape the destination directory during archive extraction by chaining malicious symbolic links that resolve outside the target path. A victim who calls extractall() on a crafted 7z archive can have files written to arbitrary host filesystem locations, potentially escalating to remote code execution, privilege escalation, or data corruption. Publicly available exploit code exists (PoC published in the GHSA advisory), but there is no public exploit identified for active campaigns at time of analysis.
RemediationAI
Vendor-released patch: upgrade py7zr to 1.1.3 or later (pip install --upgrade 'py7zr>=1.1.3'), which hardens path traversal checks and adds regression tests covering the chained-symlink scenario; see https://github.com/miurahr/py7zr/releases/tag/v1.1.3 and the advisory https://github.com/miurahr/py7zr/security/advisories/GHSA-q6rc-2cgv-63h7. If upgrading immediately is not possible, refuse to extract 7z archives from untrusted sources, or extract into a disposable sandbox (separate container, unprivileged user, ephemeral chroot) where symlinks outside the extraction root cannot reach sensitive paths - this prevents arbitrary writes but adds operational overhead and may break workflows that rely on extracted symlinks. As an additional compensating control, pre-scan archives and reject any entry whose type is symlink with a target containing '..' or absolute paths, accepting that this will also block legitimate symlinks in archives.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
py7zr is a pure-Python 7-Zip archive library (pkg:pip/py7zr) widely used by Python applications, data pipelines, and CI tooling that need to read or write 7z files without native dependencies. The root cause is CWE-59 (Link Following): the extractor validates the symlink's arcname against the destination directory but does not resolve the combined target path after each link is materialized on disk. By writing a chain of relative symlinks (dir1 -> dir0/.., dir2 -> dir1/.., ... dirN -> dirN-1/..), each link steps one directory upward, so a final link like myTmp -> dir8/tmp resolves to an attacker-controlled absolute path outside the extraction root. A subsequent regular file written through the chained symlink path lands wherever the chain ultimately resolves on the host filesystem.
Know when Python gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Exploitation occurs locally during extraction of an attacker-supplied archive (AV:L, UI:R), needs no authentication against py7zr (PR:N), and arbitrary file write yields full C/I/A impact via downstream code execution.
Primary rating from Vendor (https://github.com/miurahr/py7zr).
CVSS VectorVendor: https://github.com/miurahr/py7zr
DescriptionCVE.org
Summary
There exists an arbitrary file write vulnerability in py7zr (1.1.0, latest), which allows symbolic links to be recreated outside the destination directory via crafted malicious symbolic link chains. When using extractall to extract an archive, the library restores these symbolic links, linking them to arbitrary directories on the host file system. Subsequent extraction of regular files through these symbolic links can result in arbitrary file writes. This vulnerability may lead to remote code execution, privilege escalation, data corruption, or denial of service.
Details
The root cause of this vulnerability is that py7zr fails to properly restrict the targets of symbolic links within an archive. During extraction, the program only checks the link arcname within the destination directory, but ignores the combined symlink path resolution. Attackers can exploit this vulnerability by constructing malicious archives, thereby bypassing the directory boundary restrictions implemented by the extractor.
<img width="1806" height="834" alt="image" src="https://github.com/user-attachments/assets/cdd27ddb-ba79-4b20-b8b9-21f3e16a6e8b" />
PoC
Construct PoC Archive File
The following pseudo-code illustrates the vulnerable logic.
def create_sevenz_exp(output_dir: str):
filename = "archive.7z"
file_path = output_dir + filename
with py7zr.SevenZipFile(file_path, 'w') as archive:
archive.writestr("Some Text", "dir0/someFile.txt")
add_symlink(archive, "dir1", "dir0/..")
add_symlink(archive, "dir2", "dir1/..")
add_symlink(archive, "dir3", "dir2/..")
add_symlink(archive, "dir4", "dir3/..")
add_symlink(archive, "dir5", "dir4/..")
add_symlink(archive, "dir6", "dir5/..")
add_symlink(archive, "dir7", "dir6/..")
add_symlink(archive, "dir8", "dir7/..")
add_symlink(archive, "myTmp", "dir8/tmp")
archive.writestr("Malicious Text\n", "myTmp/poc.txt")Unpack the archive
Use common decompression methods, then extract the archive.
import sys
import os
import py7zr
def extract_7z(seven_path, output_dir):
os.makedirs(output_dir, exist_ok=True)
with py7zr.SevenZipFile(seven_path, mode='r') as z:
z.extractall(path=output_dir)
print(f"Extracted '{seven_path}' to '{output_dir}'")
if __name__ == "__main__":
seven_file = sys.argv[1]
base_name = os.path.splitext(os.path.basename(seven_file))[0]
output = base_name + "_sevenz_output"
extract_7z(seven_file, output)Impact
<img width="1268" height="572" alt="image" src="https://github.com/user-attachments/assets/919b5ff6-97ba-4781-b3e4-e9c9cc0f229b" />
After decompression, the output directory contains a sequence of symbolic links, which can finally point to the system root directory. Then, when extracting a regular file, the file will be written to an arbitrary path.
Executive ViewAI
A critical arbitrary file write vulnerability in py7zr (versions 1.1.0-1.1.2) allows attackers to write files to arbitrary filesystem locations when processing malicious 7z archives, with potential for remote code execution or privilege escalation. Any organization with applications or services using py7zr to handle archives-particularly those processing user-supplied or externally-sourced files-faces immediate operational risk. Unpatched systems processing compromised archives could experience data corruption, unauthorized code execution, or full system compromise.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict 7z archive extraction to trusted, pre-validated sources only; (2) Extract archives to a sandboxed, isolated filesystem with strict permission controls; (3) Run extraction processes with minimal required privileges; (4) Implement file integrity monitoring on extraction directories; (5) Conduct cryptographic validation of archive authenticity before processing; (6) Consider disabling 7z support entirely if not business-critical until patched versions are available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Exploit-DB