PT-2022-27330 · Py7Zr+2 · Py7Zr+2

0Xless + 1 · Published 2022-12-06 · Updated 2025-05-17 · CVE-2022-44900

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions py7zr versions 0.20.0 and earlier

Description A directory traversal issue in the SevenZipFile.extractall() function allows attackers to write arbitrary files by extracting a crafted 7z file.

Recommendations For py7zr versions 0.20.0 and earlier, consider disabling the SevenZipFile.extractall() function until a patch is available to prevent arbitrary file writes.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-44900

DSA-5652-1

GHSA-M8XW-9X5X-6VH3

OPENSUSE-SU-2024:12586-1

OPENSUSE-SU-2025:15101-1

PYSEC-2022-42998

USN-7030-1

Affected Products

Linuxmint

Ubuntu

Py7Zr

References · 23

• 🔥 https://lessonsec.com/cve/cve-2022-44900 · Exploit
• 🔥 http://packetstormsecurity.com/files/170127/py7zr-0.20.0-Directory-Traversal.html · Exploit
• https://github.com/miurahr/py7zr/commit/1bb43f17515c7f69673a1c88ab9cc72a7bbef406 · Patch
• https://osv.dev/vulnerability/GHSA-m8xw-9x5x-6vh3 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-44900 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7030-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-44900 · Security Note
• https://osv.dev/vulnerability/DSA-5652-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15101-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-42998 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-44900 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-44900 · Security Note
• https://ubuntu.com/security/notices/USN-7030-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-44900 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-44900 · Vendor Advisory