CVE-2026-45384: Arbitrary File Overwrite in bit7z via Symlink Attack

Technical summary

CVE-2026-45384 is an arbitrary file overwrite vulnerability in bit7z versions prior to 4.0.12, rooted in insecure handling of temporary files during archive update operations. The vulnerability stems from predictable temporary file paths (CWE-377: Improper Restriction of Rendered UI Layers or Frames and CWE-59: Improper Link Resolution Before File Access). An attacker with local user privileges can create a symbolic link pointing to a sensitive file path before the library writes to its expected temp location, causing the library to overwrite that target file with archive contents. The attack requires the attacker to predict or observe the temp file path and have write access to the directory where the symlink is created.

Business impact

Applications that integrate bit7z for archive handling face local privilege escalation and data integrity risks. If a service running with elevated privileges uses bit7z to process archives, an unprivileged user could overwrite configuration files, binaries, or other critical files to gain elevated access or deny service. For applications handling sensitive archives, this could lead to unauthorized modification of extracted data or system state. The impact is limited to local attackers, reducing the blast radius compared to remote vulnerabilities, but organizations shipping bit7z should audit which applications depend on it and in what security contexts.

Affected systems

Any application or service that uses bit7z library versions before 4.0.12 is affected. This includes desktop applications, build tools, backup utilities, and server-side archive processing software. The vulnerability requires local access, so impact is primarily on multi-user systems, shared hosting environments, or scenarios where untrusted local users exist. Organizations should inventory their software supply chain to identify which internal or third-party tools embed bit7z.

Exploitability

Exploitation requires local access and predictable temp file behavior. The attack vector is local with low attack complexity—an attacker simply needs to race the creation of a symlink before bit7z writes to the temp file. No authentication bypass or network access is required. However, successful exploitation depends on knowledge of the temp directory path and timing, which somewhat limits casual exploitation. This is not a remote or unauthenticated attack, but for systems with untrusted local users, it is readily exploitable. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning no public weaponized exploits targeting this flaw have been broadly reported as of the advisory date.

Remediation

Upgrade bit7z to version 4.0.12 or later. This release includes fixes for secure temporary file creation, likely implementing a cryptographically random temp file name or using OS-level secure temp APIs that prevent symlink attacks. Organizations should verify patch availability for any downstream applications or distributions that bundle bit7z, as the fix may need to be applied at multiple layers of the software stack.

Patch guidance

Apply bit7z version 4.0.12 or newer. Verify that applications depending on bit7z have been updated or rebuilt against the patched library. For server-side or containerized deployments, ensure updated container images are pushed and running instances restarted. For desktop or installed software, coordinate with end users or leverage software update mechanisms. Test archive update operations in a staging environment before production deployment to confirm the patch does not introduce regressions.

Detection guidance

Monitor system calls or file operations for suspicious symlink creation in shared temp directories (e.g., /tmp on Unix). Watch for processes attempting to follow or overwrite files via symlinks, especially during archive operations. File integrity monitoring (FIM) on critical configuration and binary directories can detect unauthorized modifications. On multi-user systems, audit processes running archive operations and flag unexpected file ownership changes or overwrites. Look for logs indicating archive update or extraction failures that coincide with symlink creation.

Why prioritize this

Medium severity (CVSS 6.1) reflects the local-only attack vector and the requirement for an attacker to possess user-level access. However, priority should be elevated if: (1) your application runs archive operations with elevated privileges in a multi-user context, (2) bit7z is embedded in widely deployed software, or (3) the application processes archives from untrusted sources. Organizations in secure, single-user, or air-gapped environments may deprioritize, but multi-tenant systems and those handling archive processing as a service should patch promptly.

Risk score, explained

The CVSS 3.1 score of 6.1 (Medium) reflects: Attack Vector Local (AV:L), Attack Complexity Low (AC:L), Privileges Required Low (PR:L), User Interaction None (UI:N), Scope Unchanged (S:U), Confidentiality None (C:N), Integrity High (I:H), and Availability Low (A:L). The high integrity impact acknowledges arbitrary file overwrite; the limited attack vector and requirement for local privileges cap the overall severity. The slight availability impact accounts for potential service disruption if critical files are overwritten.

Frequently asked questions