AIKIDO-2026-10013

TL;DR

Affected versions of this package are vulnerable to a Plaintext Archive Header Information Disclosure. When archive header encryption is explicitly enabled set_encrypt_header(true), a size optimization check in the code incorrectly bypasses encryption for small entries; because the check compares raw header size against compressed size plus a constant without accounting for AES encryption padding, it often writes the header (containing filenames, directory structure, and timestamps) in plain text. An attacker could exploit this by analyzing the archive's raw bytes to extract sensitive metadata from supposedly encrypted archives, compromising confidentiality.