Skip to content
OpenAdvisories
Critical USN-7030-1 1 CVE

py7zr vulnerability

Published Sep 24, 2024 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that py7zr was vulnerable to path traversal attacks.
If a user or automated system were tricked into extracting a specially
crafted 7z archive, an attacker could possibly use this issue to write
arbitrary files outside the target directory on the host.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS py7zr 0.11.3+dfsg-4ubuntu0.1

Vulnerabilities 1

  • Critical 9.1
    CVE-2022-44900 Public exploit

    py7zr directory traversal vulnerability

    A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file.

    py7zr py7zr py7zr Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2022-44900