The sevenz-rust2 library contains a flaw that allows an attacker to supply a crafted 7z archive with path names that are not normalised or checked for containment. When the library decompresses entries, it constructs the destination path with dest.join(entry.name()), which can resolve to a location outside the intended extraction directory or, if the entry is an absolute path, bypass the join entirely. The archive entries are written with File::create without any containment verification, enabling overwriting of arbitrary files on the system. If the decompression is performed by a privileged process, the attacker can replace configuration, startup, cron, or build files, potentially leading to remote code execution or persistent compromise.

All installations of hasenbanck:sevenz-rust2 preceding version 0.21.1 are affected. The vulnerability persists across all convenience extraction functions—decompress, decompress_file, decompress_with_password, and decompress_file_with_password—because each ultimately uses the same default path resolution logic.

The CVSS score of 6.1 indicates medium severity, and no EPSS score is available; the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or server‐side processing of attacker‑controlled 7z archives; an application that automatically extracts uploaded or otherwise untrusted archives could be tricked into overwriting critical system files. If the decompression routine runs with elevated privileges, the overwrite could provide a privilege escalation or remote code execution path.