Repository navigation
[BUG] CVE-2026-48095 in 7zip not addressed #181
Description
Is there an existing issue for this?
- I have searched the existing issues
Current Behavior
Regarding 7zips CVE:
CVE-2026-48095
https://www.tenable.com/plugins/nessus/317682
Expected Behavior
One would have expected the current release to move to version 26.01, not 26.00
Steps To Reproduce
See CVE above
Environment
- OS:
- How docker service was installed:CPU architecture
x86-64
Docker creation
N/AContainer logs
N/A
Activity
github-actions commentedon Jun 5, 2026
Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.
aptalca commentedon Jun 6, 2026
It will be updated when alpine patches/updates in their repo
thelamer commentedon Jun 6, 2026
Naw it is only updated in 25.01 which was 2 days ago on Alpine 3.23, I just pushed branches for rebases PRs incoming.
I should not be the maintainer on this repo anymore I think this was carried over from the necro image we forked to revive it with the new fork ingestion.
thelamer commentedon Jun 6, 2026
#182
#183
opless commentedon Jun 6, 2026
Apparently 7z has no maintainer on alpine currently.
Perhaps ingest 7zip directly from source?
Grateful for your fast responses
opless commentedon Jun 15, 2026
Please add the following to your container
Snzbget needs a similar update.
NB. There is no maintainer on alpine for 7zip, this is to fix the cve problem.
Another option is to use a minimal Debian/Ubuntu release which will likely result in bloating.
FROM lscr.io/linuxserver/nzbget:latest AS patcher
RUN apk del 7zip
&& apk add --no-cache tar xz
&& cd /tmp
&& wget https://github.com/ip7z/7zip/releases/download/26.01/7z2601-linux-x64.tar.xz
&& tar -xf 7z2601-linux-x64.tar.xz
FROM lscr.io/linuxserver/nzbget:latest
COPY --from=patcher /tmp/7zzs /usr/bin/7zz
LinuxServer-CI commentedon Jul 16, 2026
This issue has been automatically marked as stale because it has not had recent activity. This might be due to missing feedback from OP. It will be closed if no further activity occurs. Thank you for your contributions.
LinuxServer-CI commentedon Oct 15, 2026
This issue is locked due to inactivity