bit7z v4.0.12 Patches CVE-2026-45380/45384: Path Traversal via Symlink Misuse in Extraction and Archive Update

Vulnerability Overview Bit7z v4.0.12 fixes two CVEs reported by @Smartfoxx: 1. CVE-2026-45380: There is an error when bit7z restores symbolic links. An attacker can construct an archive that, when extracted on non-Windows platforms, creates symbolic links to escape to the parent directory of the output directory. Subsequent extraction of archive entries through these symbolic links may write arbitrary files to the parent directory of the extraction directory, with permissions determined by the extraction process. 2. CVE-2026-45384: When updating archives, bit7z uses temporary files with predictable names (e.g., ). This allows an attacker with write permissions in the archive directory to pre-place a symbolic link pointing to an arbitrary target file. When the process subsequently updates the archive, the symbolic link is followed, overwriting the target file. Scope of Impact CVE-2026-45380: - Non-Windows platforms are affected. - Windows platforms are not affected because symbolic link restoration is not supported on this platform. - On POSIX platforms, attackers can escape at most one directory level. CVE-2026-45384: - The attacker must pre-exist with write permissions to the directory containing the archive. - Creating symbolic links on Windows typically requires administrator privileges or the enabling of Developer Mode. Remediation CVE-2026-45380: - Newline characters in symbolic link target paths are now considered valid, consistent with POSIX platforms. - Path strings embedded with null characters are now handled correctly: - When , null characters are rejected and an exception is thrown. - When , null characters are replaced with , consistent with how invalid characters are handled on Windows. - Symbolic links are now recreated with targets relative to the parent directory of the symbolic link itself, matching the way the operating system resolves them at runtime; targets are still validated to ensure they remain within the extraction output directory. CVE-2026-45384: - When updating archives, bit7z no longer directly opens . Instead, it creates a private temporary directory (using with random suffixes and permissions set to 0700) and writes the new archive to this directory. - On POSIX, because directory names are unpredictable and inaccessible to other users, attackers cannot pre-place symbolic links on the temporary file path. - On Windows, since is unavailable and creating symbolic links typically requires elevated privileges, the predictable extension is retained. However, if the file does not exist, it is created; if a file or symbolic link already exists, it results in a error, and attempts are made to use numeric suffixes ( , , ..., up to 65,535 times); behavior is consistent with 7-Zip. - In both cases, now uses instead of to check for existence, ensuring dangling symbolic links are also detected. Other Changes Improved error messages. Output archive paths without a filename component are rejected with a clear error message. Silent creation of single-volume archives is no longer performed when updating multi-volume archives. Improved path sanitization across all platforms. Improved path validation and sanitization in extraction callbacks. Moved long path prefix formatting into to improve encapsulation. Improved handling of maximum path lengths on individual platforms. Improved test coverage. Contributors Smartfoxx Assets 25 assets 2 likes Additional Information This is a maintenance release. For the complete changelog of other changes in bit7z v4, please visit the GitHub Release Page. Binaries compiled with Clang10, GCC 9, MinGW 8, MSVC 2015, 2017, 2019, and 2022.

Goal Reached Thanks to every supporter — we hit 100%!

bit7z v4.0.12 Patches CVE-2026-45380/45384: Path Traversal via Symlink Misuse in Extraction and Archive Update

More from this source