sevenz-rust2 is a Rust-native 7z compressor and "decompress"or. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In "src/util/decompress.rs", "decompress_impl" computes each destination with "dest.join(entry.name())" without normalizing the archive's UTF-16 entry name or verifying containment, and "default_entry_extract_fn" writes to it with "File::create". Parent-directory components escape the extraction root, and an absolute entry path makes the join discard the destination entirely. The convenience entry points "decompress", "decompress_file", "decompress_with_password", and "decompress_file_with_password" all use this default path. Overwriting writable configuration, startup, cron, or build files can lead to code execution or persistence. The archive bytes are the attacker-controlled trust boundary, including for applications that automatically unpack uploaded or otherwise untrusted archives. This issue is fixed in version 0.21.1.