CVE-2026-61725 sevenz-rust2: unchecked 7z entry paths permit traversal and absolute-path file overwrites

sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In src/util/decompress.rs, decompressimpl computes each destination with dest.joinentry.name without normalizin...

CVE-2026-61725 sevenz-rust2: unchecked 7z entry paths permit traversal and absolute-path file overwrites

sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In src/util/decompress.rs, decompressimpl computes each destination with dest.joinentry.name without normalizin...

CVE-2026-61725

The sevenz-rust2 Rust-native 7z compressor/decompressor (prior to version 0.21.1 ) is vulnerable to a path traversal issue in src/util/decompress.rs. The decompress_impl function fails to normalize UTF-16 entry names or verify containment when computing destination paths using dest.join(entry.nam...

CVE-2026-61725: hasenbanck sevenz-rust2: sevenz-rust2 is a Rust-native 7z compressor and `decompress`or

sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In src/util/decompress.rs, decompressimpl computes each destination with dest.joinentry.name without normalizin...