PT-2026-76525

Summary All versions of sevenz-rust fail to validate file paths when extracting in decompress impl the underlying function used in the exposed decompress api functions. This oversight allows a maliciously crafted archive to extract outside the extraction directory, from both relative paths such a...