---
id: RUSTSEC-2026-0245
title: >-
  Relative/Absolute Path Traversal (CWE-23/CWE-36) in `decompress_impl` that
  enables an arbitrary file write.
summary: >-
  Relative/Absolute Path Traversal (CWE-23/CWE-36) in `decompress_impl` that
  enables an arbitrary file write.
severity: none
vendor: sevenz-rust
product: sevenz-rust
ecosystem: rust
affected:
  - sevenz-rust >= 0.0.0-0
published: '2026-08-06'
updated: '2026-08-10'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0245'
references:
  - url: 'https://crates.io/crates/sevenz-rust'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0245.html'
tags:
  - osv
  - rust
ingestedAt: '2026-08-10T19:16:48.863Z'
---

## Overview

## Summary

All versions of `sevenz-rust` fail to validate file paths when extracting in `decompress_impl` (the underlying function used in the exposed decompress api functions). 

This oversight allows a maliciously crafted archive to extract outside the extraction directory, from both relative paths such as `../../../...` or absolute paths like `C:\\...` or `/etc/...`, which could lead to file disclosure or remote command execution in combination with other flaws or social engineering.

## Details

The following line numbers will be referencing the latest version v0.6.1. The specific point of failure is at `de_funcs.rs::101` inside `decompress_impl`.
``` rust
seven.for_each_entries(|entry, reader| {
    let dest_path = dest.join(entry.name());
    extract_fn(entry, reader, &dest_path)
})?;
```
When the function iterates through each entry, it blindly joins the entry name with the output directory before passing the path into `extract_fn`, `default_entry_extract_fn` unless specified otherwise by user. This allows for relative path traversal from simple path concatenation and absolute path traversal due to [std::path::join](https://doc.rust-lang.org/std/path/struct.Path.html#method.join)'s edge case where if the "[passed] path is absolute, it replaces the current path."

`default_entry_extract_fn` also fails to validate if the entry it is given has a safe extraction path before it writes to disk at `de_funcs.rs::135`.  

## Status

The project has been abandoned and the repository has been deleted, so no upstream fix is expected. Users should migrate away from the library in favor of a modern up-to-date 7z library such as `sevenz-rust2`.

## Affected packages

- `sevenz-rust >= 0.0.0-0`

## Remediation

Refer to the advisory for the patched release.