Executive brief
py7zr is a Python library used for compressing and decompressing 7zip archives. A security flaw allows a specially crafted archive to write files to locations outside of the intended folder on a user's computer. This could allow an attacker to overwrite sensitive system files, potentially leading to full system takeover, data loss, or service disruptions.
Technical details
An arbitrary file write vulnerability exists in py7zr versions 1.1.2 and below due to improper link resolution during archive extraction. The 'extractall' function fails to validate the combined resolution of symbolic link chains, allowing an attacker to create symlinks that point outside the target destination directory. By including a regular file in the archive that references these malicious symlinks, an attacker can achieve arbitrary file writes on the host filesystem. This can lead to remote code execution or privilege escalation if sensitive files (like authorized_keys or system binaries) are overwritten. The issue is fixed in version 1.1.3.
Affected products
- miurahr py7zr <= 1.1.2
Timeline
- 2026-06-19: patched: Version 1.1.3 released to fix the vulnerability.
- 2026-06-19: advisory: GitHub Security Advisory GHSA-q6rc-2cgv-63h7 published.
- 2026-06-24: disclosed: CVE-2026-23879 published to the NVD.