# CVE-2026-23879: miurahr py7zr arbitrary file write via symbolic link resolution

Source: https://junglewise.ai/threats/cve-2026-23879-miurahr-py7zr-arbitrary-file-write-via-symbolic-link-resolution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-24. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-23879 · Severity: high · CVSS 8 · Published 2026-06-24

py7zr is a Python library used for compressing and decompressing 7zip archives. A security flaw allows a specially crafted archive to write files to locations outside of the intended folder on a user's computer. This could allow an attacker to overwrite sensitive system files, potentially leading to full system takeover, data loss, or service disruptions.

Technologies: [py7zr (PyPI)](https://junglewise.ai/threats/technologies/py7zr). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-23879 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-23879 being exploited in the wild.

**How severe is CVE-2026-23879?** High severity, with a CVSS score of 8, published 24 June 2026.

**Which products and versions are affected?** py7zr (PyPI) <= 1.1.2, ECOSYSTEM:introduced=0,fixed=1.1.3.

**Is there a fix for CVE-2026-23879?** Yes. py7zr (PyPI): upgrade to 1.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-23879 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-23879?** Check whether you run py7zr (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- py7zr (PyPI): upgrade to 1.1.3 or later

  ```sh
  pip install "py7zr>=1.1.3"
  ```


## Technical details

An arbitrary file write vulnerability exists in py7zr versions 1.1.2 and below due to improper link resolution during archive extraction. The 'extractall' function fails to validate the combined resolution of symbolic link chains, allowing an attacker to create symlinks that point outside the target destination directory. By including a regular file in the archive that references these malicious symlinks, an attacker can achieve arbitrary file writes on the host filesystem. This can lead to remote code execution or privilege escalation if sensitive files (like authorized_keys or system binaries) are overwritten. The issue is fixed in version 1.1.3.

## Affected products

- miurahr py7zr <= 1.1.2

## Identifiers

- CVE-2026-23879
- GHSA-q6rc-2cgv-63h7
- PYSEC-2026-2974

## Timeline

- 2026-06-19: patched: Version 1.1.3 released to fix the vulnerability.
- 2026-06-19: advisory: GitHub Security Advisory GHSA-q6rc-2cgv-63h7 published.
- 2026-06-24: disclosed: CVE-2026-23879 published to the NVD.

## References

- [https://github.com/miurahr/py7zr/releases/tag/v1.1.3](https://github.com/miurahr/py7zr/releases/tag/v1.1.3)
- [https://github.com/miurahr/py7zr/security/advisories/GHSA-q6rc-2cgv-63h7](https://github.com/miurahr/py7zr/security/advisories/GHSA-q6rc-2cgv-63h7)

## Related threats

- [miurahr py7zr denial of service in PackInfo header parsing](https://junglewise.ai/threats/cve-2026-55206-miurahr-py7zr-denial-of-service-in-packinfo-header-parsing)
- [miurahr py7zr decompression bomb denial of service in Worker.decompress](https://junglewise.ai/threats/cve-2026-55195-miurahr-py7zr-decompression-bomb-denial-of-service-in-worker)
- [py7zr directory traversal vulnerability](https://junglewise.ai/threats/cve-2022-44900-py7zr-directory-traversal-vulnerability)