# Security patch: Insecure handling of 7zip archives **URL:** \ **Category:** Announcements\ **Tags:** ingest-file\ **Created:** [June 12, 2025, 4:44pm UTC](https://aleph.discourse.group/t/security-patch-insecure-handling-of-7zip-archives/280 "2025-06-12T16:44:12Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![ezana.ceman](https://yyz2.discourse-cdn.com/free1/user_avatar/aleph.discourse.group/ezana.ceman/32/26_2.png) [@ezana.ceman](https://aleph.discourse.group/u/ezana.ceman)\ **Post date:** [June 12, 2025, 4:44pm UTC](https://aleph.discourse.group/t/security-patch-insecure-handling-of-7zip-archives/280/1 "2025-06-12T16:44:12Z")
Versions of ingest-file released before June 12th, 2025, contained a security vulnerability due to insecure handling of 7zip archives. ### Summary When processing 7zip archives, ingest-file followed symbolic links even if they were targeting files outside of the archive. A maliciously crafted archive would allow an attacker to access arbitrary files in the ingest-file container. Depending on the exact configuration and deployment method, this might include: - Access to files uploaded to Aleph if using the file archive (rather than object storage such as S3 or Google Cloud Storage) as the file archive is mounted into the container. - Access to environment variables. - Access to secrets mounted into the container. ### Affected versions This affects all versions of [ingest-file](https://github.com/alephdata/ingest-file) prior to 4.1.2. ### How to update Please refer to [the release notes of the patch release](https://github.com/alephdata/ingest-file/releases/tag/4.1.2). ### Credits OCCRP would like to thank everyone who identified this vulnerability and contributed to its resolution: - Responsibly disclosed by [InterSecLab](http://interseclab.org) - Patch by[Alex Ștefănescu](https://catileptic.tech/) - Research, Testing, Validation: Alex Ștefănescu, Simon Wörpel, Jan Strozyk, Friedrich Lindenberg