2 results · Feed
-
Unscored —
`sevenz-rust` is unmaintained
The `sevenz-rust` repository has been deleted and the crate is no longer actively maintained. Users should migrate away from the library in favor of a modern up-to-date 7z library such as `sevenz-rust2`.
-
Unscored —
Relative/Absolute Path Traversal (CWE-23/CWE-36) in `decompress_impl` that enables an arbitrary file write.
## Summary All versions of `sevenz-rust` fail to validate file paths when extracting in `decompress_impl` (the underlying function used in the exposed decompress api functions). This oversight allows a maliciously crafted archive to extract outside the extrac…