Sevenz Rust2
Monthly
Arbitrary file write outside the extraction directory in sevenz-rust2 0.21.0 and earlier allows an attacker-controlled .7z archive to overwrite files on the host when an application uses the crate's default extraction APIs such as decompress_file. The issue is a Zip-Slip path traversal (CWE-22) fixed in 0.21.1; a public PoC reference exists in the GHSA advisory but is not verified as working exploit code, and no CISA KEV entry or confirmed active exploitation is reported. NVD assigns 6.1 with AV:L/UI:R, while the independent assessment applies AV:N/UI:N to services that automatically unpack uploaded archives, so exposure is highest in upload-handling backends, malware-analysis sandboxes, CI pipelines, and mod/game installers.
Arbitrary file write outside the extraction directory in sevenz-rust2 0.21.0 and earlier allows an attacker-controlled .7z archive to overwrite files on the host when an application uses the crate's default extraction APIs such as decompress_file. The issue is a Zip-Slip path traversal (CWE-22) fixed in 0.21.1; a public PoC reference exists in the GHSA advisory but is not verified as working exploit code, and no CISA KEV entry or confirmed active exploitation is reported. NVD assigns 6.1 with AV:L/UI:R, while the independent assessment applies AV:N/UI:N to services that automatically unpack uploaded archives, so exposure is highest in upload-handling backends, malware-analysis sandboxes, CI pipelines, and mod/game installers.