CVE-2026-23879: py7zr Arbitrary File Write via Symlink Path Traversal

Technical summary

CVE-2026-23879 is a path traversal vulnerability in py7zr that exploits improper symlink validation during archive extraction. The vulnerability exists because the extractall() method validates only the symbolic link's arcname (its path within the archive) against the destination directory, but fails to resolve and validate the final target path after symlink dereferencing. An attacker crafts an archive containing symlink chains that, when followed, resolve to paths outside the destination directory. Subsequent extraction of regular files through these symlinks results in writes to arbitrary filesystem locations. The vulnerability is classified as CWE-59 (Improper Link Resolution Before File Access).

Business impact

Organizations using py7zr to process untrusted or user-supplied 7zip archives face significant risk. A successful exploit could result in arbitrary code execution if an attacker overwrites executable files or configuration files loaded at runtime, privilege escalation if sensitive system files are modified, wholesale data corruption, or denial of service through filesystem manipulation. The impact is amplified in automated environments (CI/CD pipelines, backup systems, file processing services) where extraction happens without interactive oversight.

Affected systems

Any system running py7zr version 1.1.2 or earlier is affected. This includes Python applications, command-line tools, and containerized services that depend on py7zr for archive handling. The vulnerability requires an attacker to control the archive being extracted, making it most dangerous in scenarios involving untrusted uploads, downloads from external sources, or supply chain attack vectors.

Exploitability

The vulnerability has a CVSS 3.1 score of 8.0 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. Exploitation requires network access, low attack complexity, and a user with login privileges to perform the extraction (e.g., a system administrator or process running with elevated rights). User interaction is required—specifically, the user must trigger extraction of a malicious archive. The attack does not cross security boundaries; it operates within the security context of the extracting process. This is not currently listed on CISA's Known Exploited Vulnerabilities catalog.

Remediation

Upgrade py7zr to version 1.1.3 or later, which implements proper symlink target validation. Organizations should audit their codebase for use of py7zr's extractall() function and prioritize patching systems that process archives from untrusted sources. Until patching is complete, consider restricting archive extraction to isolated environments, validating archive contents before extraction, or implementing strict filesystem access controls.

Patch guidance

Update py7zr via your package manager. For pip-based environments, run 'pip install --upgrade py7zr>=1.1.3'. Verify the updated version by checking the library version in your application's dependency management system. Test extraction workflows in a non-production environment before deploying to production systems to ensure compatibility.

Detection guidance

Monitor process execution and filesystem activity for suspicious patterns: extraction of archive files followed by unexpected writes to directories outside the intended extraction path, creation of symbolic links within archive processing workflows, or modification of system binaries or configuration files immediately after archive extraction. Log all invocations of extractall() and correlate with filesystem modification events. Consider implementing file integrity monitoring on critical directories to detect unauthorized changes.

Why prioritize this

This vulnerability merits urgent attention due to its HIGH severity rating, the ease of exploitation (network-accessible, low complexity), and the potential for critical impact including remote code execution and privilege escalation. The requirement for legitimate user privileges and user interaction slightly reduces urgency in fully automated systems, but organizations with human-driven archive handling or services that process user uploads should treat this as critical. The absence of active exploitation in the wild does not diminish the threat—proactive patching is essential.

Risk score, explained

The CVSS 8.0 score reflects the combination of network accessibility, direct impact to confidentiality and integrity, high attack complexity, and the need for user interaction. While the attacker needs login privileges and user action to trigger extraction, the consequences—arbitrary file write leading to code execution—are severe. The score appropriately prioritizes this as a high-risk issue requiring swift remediation.

Frequently asked questions