{"uuid": "0b3f7b31-c52c-4204-ab2c-b263921b4cfd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-44900", "type": "seen", "source": "https://t.me/hacking_Attack/79365", "content": "Exploit Collector\npy7zr 0.20.0 Directory Traversal\n\nhttps://2.bp.blogspot.com/-8IZk1MGzGDs/WWlvRc2I8KI/AAAAAAAAINM/SaF41lFV3n4aBJrQBjJ2SaVGr7WaiJo3gCLcBGAs/s1600/h34.png \nA directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr versions 0.20.0 and earlier allows attackers to read arbitrary files on the local machine via a malicious 7z file extraction.\n\nSHA-256 | 7aa7ca72652dab91234127d8332a19316f0f61be17e1c626e65aae18d9435347\n\nDownload\nCVE-2022-44900: path traversal vulnerability in py7zr\n\nDirectory traversal vulnerability in SevenZipFile.extractall() function of\nthe python library py7zr version 0.20.0 and earlier allow attackers to read\narbitrary files on the local machine via malicious 7z file extraction.\n\nCVE-2022-44900 <https:\nvulnerability allows attackers to achieve arbitrary file read and arbitrary\nfile write. To do so, an attacker needs to create a malicious 7z archive\ncontaining a symlink to achieve an arbitrary file read and a file with a\npath traversal payload as name to achieve an arbitrary file write.\nExploiting\n\nThe script used for tests is the following:\n\nimport py7zr\nimport click\n\n@click.command()\n@click.argument(\"filename\")\n\ndef main_procedure(filename):\nwith py7zr.SevenZipFile(filename, 'r') as archive:\narchive.extractall()\n\nmain_procedure()\n\nThe vulnerabile function targeted is py7zr.SevenZipFile.extractall().\n\nA lab setup has been built to test for vulnerabilities. Directories\nstructured as follow were used:\n\n\u251c\u2500\u2500 start_point\n\u2502   \u251c\u2500\u2500 archive.7z\n\u2502   \u2514\u2500\u2500 py7zr_test.py\n\u2514\u2500\u2500 target\n\u251c\u2500\u2500 write\n\u2514\u2500\u2500 read\n\nThe start_point directory contains the script used for tests and the\nmalicious archive containing the path traversal payload in the form of the\nfilename of an archived file.\n\nTo achieve an arbitrary file read, one of the files in the archives needs\nto have ../target/write set as name. The content of the file will be\nwritten into target/write.\n\nIn a similar way, to achieve an arbitrary file read, a symlink pointing to\n../target/read needs to be present in the archive. When extracted the\nsymlink will consist of the content of target/read.\nDisclosure timeline\n\n29/10/2022 - Maintainer was notified privately of the vulnerabilities\n30/10/2022 - Response from maintainer\n01/11/2022 - Release of patched version 0.20.1\n01/11/2022 - CVE ID request\n06/12/2022 - CVE ID obtained\n06/12/2022 - Public disclosure\n------------------------------\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:01:15.155648Z"}