EXECUTIVE SUMMARY:
CVE-2026-23879(CVSS 8.0) in py7zr ≤ 1.1.2 is an arbitrary file write vulnerability caused by improper handling of symbolic links during archive extraction. When processing specially crafted 7z archives, the library fails to correctly enforce directory boundary restrictions, allowing attackers to create symlink chains that escape the intended extraction directory. As a result, extracted files can be redirected to arbitrary locations on the host filesystem outside the target folder. An attacker can exploit this by packaging malicious archives that manipulate nested symbolic links, ultimately enabling overwriting or creation of sensitive files. Successful exploitation may lead to remote code execution, privilege escalation, data corruption, or denial of service, especially in automated extraction pipelines.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
CVE-2026-23879(CVSS 8.0) in py7zr ≤ 1.1.2 is an arbitrary file write vulnerability caused by improper handling of symbolic links during archive extraction. When processing specially crafted 7z archives, the library fails to correctly enforce directory boundary restrictions, allowing attackers to create symlink chains that escape the intended extraction directory. As a result, extracted files can be redirected to arbitrary locations on the host filesystem outside the target folder. An attacker can exploit this by packaging malicious archives that manipulate nested symbolic links, ultimately enabling overwriting or creation of sensitive files. Successful exploitation may lead to remote code execution, privilege escalation, data corruption, or denial of service, especially in automated extraction pipelines.[emaillocker id="1283"]
RECOMMENDATION:We strongly recommend you to update py7zr to version 1.1.3.
REFERENCES:
The following reports contain further technical details:
[/emaillocker]