sevenz-rust2 CVE-2026-61725

Exploitation requires that the application call one of the default convenience entry points - decompress, decompress_file, decompress_with_password, or decompress_file_with_password (which route through decompress_impl with default_entry_extract_fn) - on an attacker-controlled .7z archive on sevenz-rust2 <= 0.21.0. No special library configuration or feature flag is needed; the default extraction path is vulnerable. The archive must contain an entry whose UTF-16 name includes parent-directory ('..') components or an absolute/drive-prefixed path (e.g. '../../../../tmp/pwned' or 'C:\Windows\Temp\pwned'). The limiting factor is that the victim application must actually extract the untrusted archive: for manual desktop extraction this is the UI:R the NVD vector reflects, whereas upload-handling backends, malware sandboxes, CI pipelines, and mod/game installers that auto-unpack supplied archives satisfy this with no user interaction. Impact also depends on a writable, security-relevant target file (cron, startup/autostart, config, or build artifact) existing with appropriate permissions for the extracting process to escalate the write to code execution.

This is a genuine but conditional-risk arbitrary-file-write (Zip-Slip/CWE-22) in the sevenz-rust2 Rust crate, and the signals must be read against each other rather than taken at the raw 6.1 face value. The NVD CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L) models the flaw as locally triggered, requiring a user to extract an archive, with high integrity impact and no confidentiality loss - a MEDIUM rating. However, this conflicts with the vulnerability's actual trust boundary: the GHSA advisory and description both state the exposure is highest for backends that automatically unpack uploaded/untrusted .7z files, and the maintainer explicitly recommends re-scoring network-facing consumers as AV:N/UI:N (~8.6, HIGH). So the headline 6.1 understates risk for the exact deployments that matter most (upload handlers, malware sandboxes, CI steps, mod/game installers), while overstating it for a desktop user manually extracting a trusted file. No CISA KEV listing and no EPSS score are present in the input, so there is no evidence of active or at-scale exploitation; the vuln.today Decision label is 'this_month' (a near-term, not emergency, priority). A public PoC reference exists in the GHSA advisory (step-by-step archive construction); it is not verified as working exploit code. Net: real priority for anyone extracting untrusted 7z archives, lower urgency where only trusted archives are processed. The AV discrepancy (NVD AV:L vs. advisory-recommended AV:N) should be resolved against your specific deployment - verify whether your application unpacks network-supplied archives.

An attacker uploads a crafted .7z archive to an application that automatically extracts it with sevenz-rust2's default decompress API; the archive contains an entry named like '../../../../etc/cron.d/x' or an absolute path, which escapes the destination directory and overwrites a writable cron, startup, autostart, config, or build file. On the next scheduled or triggered execution of that file the attacker's content runs, converting the file write into code execution or persistence. A public PoC reference exists in the GHSA advisory (it is not verified as working exploit code); exploitation requires the victim application to extract the attacker-supplied archive (UI:R in the NVD vector), which is implicit for auto-unpacking backends.