CVE-2026-45380: Off-by-One Path Traversal in bit7z Archive Extraction

Technical summary

CVE-2026-45380 stems from an off-by-one error in the SafeOutPathBuilder::restoreSymlink() function within bit7z versions prior to 4.0.12. The vulnerability manifests on Linux, macOS, and other non-Windows platforms where symlink support is native. The flaw allows a specially crafted 7z archive to bypass path canonicalization checks by exactly one byte, enabling creation of a symlink that traverses outside the extraction root directory. Subsequent archive entries processed after symlink creation are then extracted through that escape vector, writing to attacker-controlled paths with the privileges of the extracting process. The vulnerability combines CWE-193 (off-by-one error) with CWE-22 (path traversal).

Business impact

For organizations using bit7z in archive processing workflows—particularly those handling user-supplied or untrusted 7z files—this vulnerability introduces a file integrity and confidentiality risk. The most realistic threat scenario involves an archive processor running as a service account with elevated permissions. An attacker could craft a malicious archive to write files to system directories, inject code into application directories, or corrupt configuration files. However, exploitation requires user interaction (manual extraction or automated processing of untrusted archives) and is limited to non-Windows platforms. The LOW CVSS score reflects these constraints, but the impact can be severe in high-trust extraction environments.

Affected systems

bit7z version 4.0.11 and earlier are vulnerable on Linux, BSD, macOS, and other POSIX-compliant systems where symlink support is available. Windows systems are unaffected because the vulnerable code path is not executed on that platform. Any application statically linking bit7z (as is typical for C++ libraries) and exposing archive extraction functionality to untrusted input is at risk. This includes desktop applications, archiving utilities, backup tools, and server-side processing pipelines.

Exploitability

Exploitation requires two conditions: (1) a non-Windows platform with symlink support, and (2) user interaction or automated processing of attacker-supplied 7z archives. The vulnerability cannot be exploited remotely without a mechanism to deliver the malicious archive to the target system and trigger extraction. The one-byte nature of the error suggests the vulnerability is reliable once properly triggered, but crafting a working proof-of-concept requires understanding of the exact boundary condition. The LOW CVSS score reflects the high bar for practical exploitation in most environments, though high-risk scenarios exist in multi-user systems or service-based extraction platforms.

Remediation

Upgrade bit7z to version 4.0.12 or later. Applications should verify which version of bit7z they have statically linked and rebuild with the patched version. No workarounds exist for earlier versions beyond restricting archive extraction to trusted sources only. Organizations should audit their supply chain to identify all components and applications using bit7z and prioritize patching those exposed to untrusted archives.

Patch guidance

Verify your bit7z version by checking build artifacts, dependency manifests, or library version strings in running processes. The patch was released in version 4.0.12, which addresses the off-by-one error in the symlink restoration logic. Because bit7z is a static library, applications must be recompiled against the patched version; simply updating a system copy of the library (if present) may not protect statically-linked applications. Consult your application vendor for patch availability if you do not control the build process. Testing should confirm that extraction of legitimate archives continues to work correctly and that symlink paths are properly canonicalized.

Detection guidance

Monitor for suspicious symlink creation during archive extraction operations, particularly symlinks that point outside the intended extraction directory. Log and alert on any archive extraction attempts that result in file writes to unexpected system paths. Endpoint detection and response (EDR) tools can track processes creating symlinks followed by file modifications in sensitive directories. On systems where bit7z-based tools are deployed, enable file integrity monitoring on configuration directories and system paths to catch post-extraction modifications. Behavioral indicators include archive extraction followed by rapid filesystem activity in non-extraction directories.

Why prioritize this

While the CVSS score is LOW, prioritization depends on your specific risk profile. If your organization processes untrusted 7z archives—especially through automated pipelines or user-facing tools on Linux/macOS—this should be elevated to medium priority. If you only extract archives from trusted sources or operate primarily on Windows, it can remain low priority. The patching cost is moderate (requires recompilation), making it reasonable to address in your next regular update cycle for affected applications. Inventory your use of bit7z before deciding whether to fast-track the fix.

Risk score, explained

The CVSS 3.1 score of 3.6 (LOW) reflects: local attack vector (AV:L, not network-exploitable), high complexity requiring specific archive crafting (AC:H), no privileges required (PR:N), user interaction necessary (UI:R), and uniform scope with low impact (integrity and availability minimally affected, S:U/I:L/A:L). The score correctly penalizes a vulnerability that is hard to trigger accidentally but could be serious in targeted scenarios. Organizations should not dismiss it based on the score alone; context matters—evaluate whether you fit the high-risk profile.

Frequently asked questions