RUSTSEC-2026-0245 — Vulnerability in sevenz-rust — Advisory Details

## Summary All versions of `sevenz-rust` fail to validate file paths when extracting in `decompress_impl` (the underlying function used in the exposed decompress api functions). This oversight allows a maliciously crafted archive to extract outside the extraction directory, from both relative paths such as `../../../...` or absolute paths like `C:\\...` or `/etc/...`, which could lead to file disclosure or remote command execution in combination with other flaws or social engineering. ## Details The following line numbers will be referencing the latest version v0.6.1. The specific point of failure is at `de_funcs.rs::101` inside `decompress_impl`. ``` rust seven.for_each_entries(|entry, reader| { let dest_path = dest.join(entry.name()); extract_fn(entry, reader, &dest_path) })?; ``` When the function iterates through each entry, it blindly joins the entry name with the output directory before passing the path into `extract_fn`, `default_entry_extract_fn` unless specified otherwise by user. This allows for relative path traversal from simple path concatenation and absolute path traversal due to [std::path::join](https://doc.rust-lang.org/std/path/struct.Path.html#method.join)'s edge case where if the "[passed] path is absolute, it replaces the current path." `default_entry_extract_fn` also fails to validate if the entry it is given has a safe extraction path before it writes to disk at `de_funcs.rs::135`. ## Status The project has been abandoned and the repository has been deleted, so no upstream fix is expected. Users should migrate away from the library in favor of a modern up-to-date 7z library such as `sevenz-rust2`.