Vulnerability Description
bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.12, a one-byte off-by-one error in SafeOutPathBuilder::restoreSymlink() allows an attacker to craft a .7z archive that, when extracted with bit7z on any non-Windows platform, creates a symlink escaping the intended output directory. Subsequent archive entries extracted through this symlink write arbitrary files outside the extraction directory with the permissions of the extracting process. This issue has been patched in version 4.0.12.
CVSS Score
LOW
Related Weaknesses (CWE)
References
- https://github.com/rikyoz/bit7z/releases/tag/v4.0.12
- https://github.com/rikyoz/bit7z/security/advisories/GHSA-8wj8-9jwv-j24v
- https://github.com/rikyoz/bit7z/security/advisories/GHSA-8wj8-9jwv-j24v
FAQ
What is CVE-2026-45380?
CVE-2026-45380 is a vulnerability with a CVSS score of 3.6 (LOW). bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.12, a one-byte off-by-one error in SafeOutPathBuilder::restoreSymlink() allow...
How severe is CVE-2026-45380?
CVE-2026-45380 has been rated LOW with a CVSS base score of 3.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-45380?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.