PYSEC-2022-42998

2022-12-0620:15:00

Google

osv.dev

directory traversal

python

sevenzipfile

vulnerability

arbitrary files

7z file

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

0.008 Low

EPSS

Percentile

81.3%

JSON

A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file.

CPENameOperatorVersion
py7zreq0.15.1
py7zreq0.18.12
py7zreq0.7.0
py7zreq0.17.4
py7zreq0.11.0b2
py7zreq0.20.0
py7zreq0.11.0b1
py7zreq0.6b6
py7zreq0.7.4
py7zreq0.9.0