EUVD-2026-36115Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Local vector and PR:L reflect the requirement for write access to the archive directory; I:H captures arbitrary file overwrite; C:N because no data is read; A:L for file corruption.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Lifecycle Timeline
3DescriptionCVE.org
bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.12, there is an arbitrary file overwrite vulnerability via symlink attack on predictable temp files during archive update. This issue has been patched in version 4.0.12.
AnalysisAI
Arbitrary file overwrite in bit7z prior to version 4.0.12 is possible through a symlink attack targeting the predictable temporary file (<archive_path>.tmp) created during archive update operations. An attacker with write access to the archive directory can pre-place a symlink at that path pointing to a sensitive target file; when a process subsequently calls bit7z to update an archive, the library follows the symlink and overwrites the target with archive data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker hold write permission on the directory containing the archive at the time a bit7z archive update operation is initiated - this is the single binding prerequisite confirmed by the vendor release notes. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L scoring 6.1 (Medium) is consistent with the described mechanics: local access, low complexity, low privilege, no interaction needed, no confidentiality impact, high integrity impact, and low availability impact from file corruption. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker sharing a filesystem with a service or privileged process that periodically updates bit7z-managed archives creates a symlink at `<archive_path>.tmp` pointing to a sensitive file such as a cron script or a service configuration file. When the privileged process next triggers an archive update, bit7z opens the symlink path for writing and overwrites the target file with archive data, corrupting or replacing it in a way the attacker partially influences through archive content. … |
| Remediation | Vendor-released patch: v4.0.12. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today