EUVD-2026-36115Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Local vector and PR:L reflect the requirement for write access to the archive directory; I:H captures arbitrary file overwrite; C:N because no data is read; A:L for file corruption.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.12, there is an arbitrary file overwrite vulnerability via symlink attack on predictable temp files during archive update. This issue has been patched in version 4.0.12.
AnalysisAI
Arbitrary file overwrite in bit7z prior to version 4.0.12 is possible through a symlink attack targeting the predictable temporary file (<archive_path>.tmp) created during archive update operations. An attacker with write access to the archive directory can pre-place a symlink at that path pointing to a sensitive target file; when a process subsequently calls bit7z to update an archive, the library follows the symlink and overwrites the target with archive data. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though its low-complexity prerequisites on POSIX systems make it a meaningful risk in shared-directory or multi-tenant environments.
Technical ContextAI
bit7z (CPE: cpe:2.3:a:rikyoz:bit7z:*:*:*:*:*:*:*:*) is a cross-platform C++ static library for archive compression and extraction, exposing a clean API over the 7-zip engine. The root cause is CWE-59 (Improper Link Resolution Before File Access - 'Link Following'): during archive update operations, the library derives a temp file path deterministically as <archive_path>.tmp and opens it for writing without first verifying that the path resolves to a regular file rather than a symlink. POSIX kernels follow symlinks transparently on open(), so any write intended for the temp file is silently redirected to the symlink target. This is a classic TOCTOU-adjacent pattern requiring no race window - the attacker sets up the symlink before the operation begins. Windows is substantially less exposed because creating symbolic links there typically requires administrator privileges or Developer Mode, whereas on Linux and macOS any user with directory write permission can create symlinks.
RemediationAI
Vendor-released patch: v4.0.12. Upgrading to bit7z 4.0.12 is the definitive fix per the vendor advisory at https://github.com/rikyoz/bit7z/releases/tag/v4.0.12. If immediate upgrade is not feasible, restrict write permissions on archive-containing directories to only the specific user or service account performing archive updates, preventing any other principal from pre-placing the symlink; note this may not be practical in shared-directory deployments. On Linux, enabling the protected_symlinks sysctl (fs.protected_symlinks=1) blocks symlink following when the directory owner differs from the link owner, directly mitigating this attack class with no functional side effects for most workloads. On Windows, ensure Developer Mode is disabled and that no untrusted users hold administrator rights, as both are prerequisites for symlink creation there. None of these compensating controls are as reliable as applying the patch.
Bit7z versions prior to 4.0.11 contain a path traversal vulnerability that allows arbitrary file writes outside the inte
Path traversal via crafted .7z archive in bit7z before v4.0.12 on POSIX platforms allows an attacker-controlled symlink
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today