AIKIDO-2026-428616
sevenz-rust2 is vulnerable to Path Traversal
70
High Risk
This Affects:
sevenz-rust2TL;DR
sevenz-rust2 extracts 7z archives by joining each archive entry name directly onto the destination directory without validating it. A crafted archive whose entry names contain .. traversal sequences, absolute paths, or Windows drive/root prefixes causes extracted files to be written outside the intended destination directory. An attacker who supplies a malicious archive can overwrite arbitrary files on the system, which can lead to code execution. The fix adds a safe_join helper that rejects parent-directory, root, and drive-prefix components and treats backslashes as separators on every platform.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application extracts untrusted or attacker-supplied 7z archives.
Background info
sevenz-rust2 is vulnerable to Path Traversal in versions 0.7.0 - 0.21.0.
How to fix this
Upgrade the sevenz-rust2 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.