PT-2026-51047 · Pypi · Py7Zr

Published 2026-06-19 · Updated 2026-06-19 · CVE-2026-23879

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions py7zr version 1.1.0

Description An arbitrary file write issue exists when using the extractall() function to extract an archive. The software fails to properly restrict the targets of symbolic links, allowing crafted malicious symbolic link chains to be recreated outside the destination directory. By bypassing directory boundary restrictions, the library restores symbolic links that point to arbitrary directories on the host file system. Subsequent extraction of regular files through these links enables writing files to arbitrary paths, which may lead to remote code execution, privilege escalation, data corruption, or denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2026-23879

GHSA-Q6RC-2CGV-63H7

Affected Products

Py7Zr

References · 5

• https://osv.dev/vulnerability/GHSA-q6rc-2cgv-63h7 · Vendor Advisory
• https://github.com/miurahr/py7zr · Note
• https://github.com/miurahr/py7zr/security/advisories/GHSA-q6rc-2cgv-63h7 · Note
• https://github.com/miurahr/py7zr/releases/tag/v1.1.3 · Note
• https://twitter.com/dailycve/status/2068060743660962013 · Twitter Post