Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-44722— pyzipper: Encryption bypass for small files encrypted with pyzipper

CVSS 6.2 · Medium EPSS 0.09% · P0

Possible ATT&CK Techniques 1AI

T1041 · Exfiltration Over C2 Channel

Affected Version Matrix 1

VendorProductVersion RangeStatus
danifuspyzipper< 0.4.0affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-44722

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
pyzipper: Encryption bypass for small files encrypted with pyzipper
Source: CVE Program / CVE List V5
Vulnerability Description
pyzipper is a replacement for Python's zipfile that can read and write AES encrypted zip files. Prior to 0.4.0, a Python operator precedence bug in pyzipper/zipfile_aes.py caused the AE-2 format to never be automatically selected during encryption, causing encrypted entries to be written in AE-1 format and exposing the plaintext CRC32 checksum in the ZIP header and, for unseekable zip archives, in the datadescripter section, allowing an attacker who possesses the archive to brute-force candidate plaintexts for small or low-entropy files by comparing CRC32 values. This issue is fixed in version 0.4.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用操作符不正确
Source: CVE Program / CVE List V5
Vulnerability Title
Daniel Hillier pyzipper 处理逻辑错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Daniel Hillier pyzipper是Daniel Hillier个人开发者的一款Python脚本工具 Daniel Hillier pyzipper 0.4.0之前版本存在处理逻辑错误漏洞，该漏洞源于pyzipper/zipfile_aes.py中Python运算符优先级错误，导致AE-2格式在加密时从未被自动选择，加密条目以AE-1格式写入，将明文CRC32校验和暴露在ZIP标头中，对于不可寻址的ZIP归档文件则暴露在数据描述符部分，从而允许拥有归档文件的攻击者通过比较CRC32值对小型或低
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
danifuspyzipper < 0.4.0 -

II. Public POCs for CVE-2026-44722

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-44722

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-44722 (1)

Vendor Advisories for CVE-2026-44722 (1)

Vendor Pages for CVE-2026-44722 (1)

IV. Related Vulnerabilities

Same weakness: CWE-480

V. Comments for CVE-2026-44722

No comments yet

Leave a comment