The flaw lies in py7zr’s extraction routine, where symbolic links inside a 7zip archive are recreated without fully resolving the symlink chain. This allows a crafted archive to place links that point outside the intended destination directory. When the extractor subsequently processes files via these links, it can overwrite arbitrary files on the host, potentially injecting malicious code, corrupting data, or disrupting services. The vulnerability is classified as CWE‑59, indicating absolute pathname traversal. As a result, the impact can range from local file corruption to full remote code execution if the extraction occurs with privileged permissions.

miurahr’s py7zr library is affected. All releases up to and including version 1.1.2 are vulnerable; the fix is available in release 1.1.3 and later. Applications that call the extractall function on untrusted archives and that use any of the impacted versions are at risk.

The CVSS score of 8 denotes high severity, but no EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is that an attacker supplies a malicious archive to an application that imports or extracts data using py7zr. Because the flaw is not triggered by network activity alone, the attacker must have a way to deliver the crafted archive to the target’s extraction code—such as via file upload or API payload. Once the archive is extracted, the attacker can create symbols that point to system files or directories, enabling arbitrary file writes. Although no public exploits have been recorded, the combination of a high severity rating and the realistic exploitation path suggests that the vulnerability should be remediated promptly.