[BUG] CVE-2026-48095 in 7zip not addressed

[opless]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

Regarding 7zips CVE:
CVE-2026-48095
https://www.tenable.com/plugins/nessus/317682

Expected Behavior

One would have expected the current release to move to version 26.01, not 26.00

Steps To Reproduce

See CVE above

Environment

- OS:
- How docker service was installed:

CPU architecture

x86-64

Docker creation

N/A

Container logs

N/A

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[aptalca]

It will be updated when alpine patches/updates in their repo

[thelamer]

Naw it is only updated in 25.01 which was 2 days ago on Alpine 3.23, I just pushed branches for rebases PRs incoming.

I should not be the maintainer on this repo anymore I think this was carried over from the necro image we forked to revive it with the new fork ingestion.

[thelamer]

#182
#183

[opless]

Apparently 7z has no maintainer on alpine currently.

Perhaps ingest 7zip directly from source?

Grateful for your fast responses

[opless]

Please add the following to your container

Snzbget needs a similar update.

NB. There is no maintainer on alpine for 7zip, this is to fix the cve problem.

Another option is to use a minimal Debian/Ubuntu release which will likely result in bloating.

FROM lscr.io/linuxserver/nzbget:latest AS patcher

RUN apk del 7zip
&& apk add --no-cache tar xz
&& cd /tmp
&& wget https://github.com/ip7z/7zip/releases/download/26.01/7z2601-linux-x64.tar.xz
&& tar -xf 7z2601-linux-x64.tar.xz

FROM lscr.io/linuxserver/nzbget:latest
COPY --from=patcher /tmp/7zzs /usr/bin/7zz

[LinuxServer-CI]

This issue has been automatically marked as stale because it has not had recent activity. This might be due to missing feedback from OP. It will be closed if no further activity occurs. Thank you for your contributions.