{"action":"Upgrade py7zr to 0.20.1 or later.","affected":[{"fixed":"0.20.1","introduced":"0"}],"component":"py7zr","cve_ids":["CVE-2022-44900"],"ecosystem":"PyPI","epss":0.02465,"exploited":false,"fixed_versions":["0.20.1"],"ghsa_id":"GHSA-m8xw-9x5x-6vh3","id":"tcs_01M5KGHB6FKDJNWASRH1W1HMAM","modified_at":"2026-06-10T17:01:39.992769112Z","published_at":"2022-12-06T20:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2022-42998","https://github.com/miurahr/py7zr/commit/1bb43f17515c7f69673a1c88ab9cc72a7bbef406","http://packetstormsecurity.com/files/170127/py7zr-0.20.0-Directory-Traversal.html","https://lessonsec.com/cve/cve-2022-44900/","https://github.com/advisories/GHSA-m8xw-9x5x-6vh3"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2022-42998","url":"https://osv.dev/vulnerability/PYSEC-2022-42998"}],"summary":"A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file"}