CVE-2026-23879
Description
A flaw was found in py7zr. An attacker can craft a malicious archive containing symbolic links that, when extracted, can lead to arbitrary file writes outside the intended directory. This vulnerability may allow for remote code execution, privilege escalation, data corruption, or denial of service.
Statement
This flaw has an Important impact as py7zr shipped in Red Hat Ansible Automation Hub is susceptible to arbitrary file writes during archive extraction. An attacker can craft a malicious 7zip archive containing symbolic link chains that resolve outside the intended extraction directory, bypassing path validation. When a user or automated pipeline extracts the archive using py7zr's extractall method, subsequent files can be written to arbitrary locations on the filesystem, potentially leading to remote code execution or data corruption.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
