crates.io/sevenz-rust: unknown

Relative/Absolute Path Traversal (CWE-23/CWE-36) in `decompress_impl` that enables an arbitrary file write.

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: RUSTSEC-2026-0245
• https://crates.io/crates/sevenz-rust
• https://rustsec.org/advisories/RUSTSEC-2026-0245.html

published 2026-08-06T12:00:00Z · modified 2026-08-10T06:30:04.779569400Z · JSON