CVE-2026-23879 Overview
CVE-2026-23879 affects py7zr, a Python library for handling 7zip archive compression, decompression, encryption, and decryption. Versions 1.1.2 and below contain an arbitrary file write vulnerability via crafted symbolic link chains in archives. The extractall function restores symbolic links without resolving the combined symlink path, allowing links to point outside the destination directory. Attackers can bypass directory boundary restrictions by constructing malicious archives. Subsequent extraction of regular files through these symbolic links results in arbitrary file writes on the host file system. The flaw is tracked as CWE-59: Improper Link Resolution Before File Access. The maintainers fixed the issue in version 1.1.3.
Critical Impact
Successful exploitation can lead to remote code execution, privilege escalation, data corruption, or denial of service on systems that extract untrusted 7zip archives with py7zr.
Affected Products
- py7zr versions 1.1.2 and below
- Python applications and utilities that invoke py7zr.extractall on untrusted archives
- Automated pipelines and services using py7zr for archive processing
Discovery Timeline
- 2026-06-24 - CVE-2026-23879 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-23879
Vulnerability Analysis
The vulnerability resides in how py7zr handles symbolic link entries during archive extraction. When extractall processes archive members, it validates the link's arcname against the destination directory boundary. The validation does not resolve the full path of the symbolic link target after combination with prior link components in a chain.
An attacker can craft an archive containing a chain of symbolic links. Each individual link appears to remain within the destination directory. The combined path resolution at file system level points to an arbitrary directory outside the extraction root. Regular file entries that follow the symlinks are then written through those links to attacker-controlled locations.
This primitive enables writing to system directories, user profile paths, configuration files, or auto-run locations. The result can be remote code execution, privilege escalation, integrity loss on protected files, or denial of service against critical components.
Root Cause
The root cause is incomplete path validation during symbolic link restoration. The extractor verifies the link entry name against the destination boundary in isolation. It does not perform canonical resolution of the symlink target relative to previously extracted links. This allows multi-step link chains to escape the intended sandbox.
Attack Vector
Exploitation requires a victim to extract an attacker-supplied 7zip archive using a vulnerable version of py7zr. The attacker delivers the archive through any channel that leads to extraction by the target application, such as upload endpoints, email attachments, or build pipelines. User interaction is required, and the attacker needs low privileges in the context of the extracting process.
No verified public proof-of-concept code is referenced in the advisory. See the GitHub Security Advisory GHSA-q6rc-2cgv-63h7 for maintainer details.
Detection Methods for CVE-2026-23879
Indicators of Compromise
- Files written outside the intended extraction directory after a py7zr extraction operation.
- Symbolic links inside extracted archives that resolve to absolute paths or paths containing .. segments.
- Unexpected modifications to system configuration files, startup directories, or user profile paths following archive processing.
Detection Strategies
- Inventory Python dependencies and flag any installation of py7zr at version 1.1.2 or earlier.
- Inspect archives prior to extraction by enumerating symlink entries and resolving their combined targets against the destination boundary.
- Audit application logs and file system telemetry for extractall invocations followed by writes outside the expected output path.
Monitoring Recommendations
- Monitor file creation and modification events in sensitive directories such as /etc, ~/.ssh, and Windows startup folders following archive processing.
- Track process activity from Python interpreters that invoke py7zr and correlate with subsequent file write events.
- Alert on symbolic link creation events in directories that should not contain symlinks under normal operation.
How to Mitigate CVE-2026-23879
Immediate Actions Required
- Upgrade py7zr to version 1.1.3 or later in all environments that process 7zip archives.
- Identify and isolate services that extract untrusted archives until the upgrade is complete.
- Rotate any credentials or secrets that may have been overwritten or exposed through arbitrary file writes.
Patch Information
The maintainers fixed the vulnerability in py7zr version 1.1.3. Upgrade using pip install --upgrade py7zr. Patch details are available in the GitHub Release v1.1.3 and the GitHub Security Advisory GHSA-q6rc-2cgv-63h7.
Workarounds
- Refuse to extract archives from untrusted sources until the patched version is deployed.
- Run extraction in an isolated sandbox or container with no write access to sensitive host directories.
- Pre-scan archives and reject any entry containing symbolic links, or strip symlink entries before extraction.
- Apply least-privilege execution so the extracting process cannot write to system or privileged paths.
# Upgrade py7zr to the patched release
pip install --upgrade 'py7zr>=1.1.3'
# Verify installed version
python -c "import py7zr; print(py7zr.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
