CVE-2022-44900
py7zr directory traversal vulnerability
A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file.
- Record
CVE-2022-44900- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List
A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file.
- Record
CVE-2022-44900- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2022-0208
A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file.
- Record
EUVD-2022-0208- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-m8xw-9x5x-6vh3
py7zr directory traversal vulnerability
A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file.
- Record
GHSA-m8xw-9x5x-6vh3- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file.
- Record
CVE-2022-44900- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-m8xw-9x5x-6vh3
py7zr directory traversal vulnerability
A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file.
- Record
GHSA-m8xw-9x5x-6vh3- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
Show 6 moreShow less
OSVUBUNTU-CVE-2022-44900
A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file.
- Record
UBUNTU-CVE-2022-44900- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-44900 No score
A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file.
- Record
DEBIAN-CVE-2022-44900- Updated
- 2026-11-03
OSVopenSUSE-SU-2024:12586-1 No score
python310-py7zr-0.20.2-1.1 on GA media
These are all security issues fixed in the python310-py7zr-0.20.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12586-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15101-1 No score
python311-py7zr-0.20.8-2.6 on GA media
These are all security issues fixed in the python311-py7zr-0.20.8-2.6 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15101-1- Updated
- 2026-11-02
OSVPYSEC-2022-42998 No score
A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file.
- Record
PYSEC-2022-42998- Updated
- 2026-11-02
OSVUSN-7030-1 No score
py7zr vulnerability
It was discovered that py7zr was vulnerable to path traversal attacks. If a user or automated system were tricked into extracting a specially crafted 7z archive, an attacker could possibly use this issue to write arbitrary files outside the target directory on the host.
- Record
USN-7030-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
py7zrPyPI |
through 0.20.0 | 0.20.1 |
py7zrDebian:12 |
before 0.11.3+dfsg-5 | 0.11.3+dfsg-5 |
py7zrDebian:13 |
before 0.11.3+dfsg-5 | 0.11.3+dfsg-5 |
py7zrDebian:14 |
before 0.11.3+dfsg-5 | 0.11.3+dfsg-5 |
py7zrDebian:11 |
before 0.11.3+dfsg-1+deb11u1, plus listed versions 0.11.3+dfsg-1 |
0.11.3+dfsg-1+deb11u1 |
py7zrPyPI |
before 0.20.1, plus listed versions 0.0.30.0.40.0.50.0.60.0.7 Show 45 moreShow less0.0.80.1.00.1.10.1.20.1.30.1.40.1.50.1.60.10.00.10.0a10.10.0a20.10.0a30.10.0a40.10.0a50.10.0a60.10.0b10.10.0b30.10.10.10.20.11.00.11.0a10.11.0b10.11.0b20.11.0b30.11.10.11.20.11.30.12.00.13.00.13.10.14.00.14.10.15.00.15.10.15.20.16.00.16.10.16.20.16.30.16.40.17.00.17.10.17.20.17.30.17.4 |
0.20.1 |
py7zrPyPI |
before 0.20.1, plus listed versions 0.0.30.0.40.0.50.0.60.0.7 Show 45 moreShow less0.0.80.1.00.1.10.1.20.1.30.1.40.1.50.1.60.10.00.10.0a10.10.0a20.10.0a30.10.0a40.10.0a50.10.0a60.10.0b10.10.0b30.10.10.10.20.11.00.11.0a10.11.0b10.11.0b20.11.0b30.11.10.11.20.11.30.12.00.13.00.13.10.14.00.14.10.15.00.15.10.15.20.16.00.16.10.16.20.16.30.16.40.17.00.17.10.17.20.17.30.17.4 |
0.20.1 |
py7zrUbuntu:22.04:LTS |
before 0.11.3+dfsg-4ubuntu0.1, plus listed versions 0.11.3+dfsg-10.11.3+dfsg-1ubuntu10.11.3+dfsg-20.11.3+dfsg-30.11.3+dfsg-4 |
0.11.3+dfsg-4ubuntu0.1 |
python-py7zropenSUSE:Tumbleweed |
before 0.20.8-2.6 | 0.20.8-2.6 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | 0xless/CVE-2022-44900-demo-lab | 2023-01-21 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-44900 is a critical vulnerability (CVSS 9.1) in Py7zr Project Py7zr, published December 6, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.46%, the 84th percentile. Fixed in py7zr 0.20.1.
References
github.com/miurahr/py7zr/commit/1bb43f17515c7f69673a1c88ab9cc72a7bbef406
packetstormsecurity.com/files/170127/py7zr-0.20.0-Directory-Traversal.html
lessonsec.com/cve/cve-2022-44900
nvd.nist.gov/vuln/detail/CVE-2022-44900
advisory-inbox.githubapp.com/advisory_reviews/GHSA-m8xw-9x5x-6vh3
Show 9 moreShow less
security-tracker.debian.org/tracker/CVE-2022-44900
ubuntu.com/security/CVE-2022-44900
cve.org/CVERecord?id=CVE-2022-44900
suse.com/security/cve/CVE-2022-44900
lists.opensuse.org/archives/list/[email protected]/thread/GTPYDSULYXFYF5DM6FNQYBZ6M5HI2JRL
Left out here: 298 versions. The JSON record has them.