Executive Summary

CVE-2026-23879 is an arbitrary file write vulnerability in the py7zr Python library, which handles 7zip archive compression and extraction. The issue arises because the library improperly validates symbolic links during archive extraction. Specifically, when extracting archives using the extractall function, py7zr only checks if the symbolic link's path is within the destination directory but fails to resolve the full symlink chain. This allows attackers to craft malicious archives containing symbolic link chains that point outside the intended extraction directory.

As a result, files can be written to arbitrary locations on the host system when extracted, bypassing directory boundary restrictions. This vulnerability affects py7zr versions 1.1.2 and below and was fixed in version 1.1.3.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including remote code execution, privilege escalation, data corruption, and denial of service. By exploiting the symbolic link flaw, an attacker can write files to arbitrary locations on the system, potentially overwriting critical files or placing malicious executables.

Because the attack requires only the extraction of a specially crafted archive, it has low attack complexity and can be performed with minimal privileges. The vulnerability affects the confidentiality, integrity, and availability of the system.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying if py7zr versions 1.1.2 or below are in use, as these versions contain the arbitrary file write flaw via symbolic link extraction.

Since the vulnerability is triggered during extraction of malicious 7z archives containing crafted symbolic link chains, monitoring extraction activities and inspecting archive contents for suspicious symbolic links can help detect exploitation attempts.

Commands to check the installed py7zr version include:

• python -m pip show py7zr
• pip freeze | grep py7zr

To detect suspicious symbolic links in extracted directories, you can use commands like:

• find /path/to/extracted/files -type l -ls
• readlink -f /path/to/symlink

Network detection is limited since the exploit requires archive extraction locally, but monitoring for unexpected file writes outside intended extraction directories or unusual symbolic link creations may indicate exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade py7zr to version 1.1.3 or later, where this arbitrary file write vulnerability has been fixed by hardening path traversal checks.

Until the upgrade can be applied, avoid extracting untrusted or suspicious 7z archives using vulnerable py7zr versions.

Additionally, implement strict file system permissions and monitor extraction directories for unexpected symbolic links or file writes outside the intended paths.

Consider applying other security best practices such as running extraction processes with least privilege to limit potential impact.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in py7zr allows arbitrary file writes outside the intended extraction directory, potentially leading to remote code execution, privilege escalation, data corruption, or denial of service.

Such impacts could compromise the confidentiality, integrity, and availability of data, which are core principles in standards and regulations like GDPR and HIPAA.

Therefore, exploitation of this vulnerability could lead to non-compliance with these regulations due to unauthorized data access or modification, data breaches, or system disruptions.

Useful 0 Not Useful 0