CVE-2026-45380: bit7z Path Traversal Vulnerability

CVE-2026-45380 Overview

CVE-2026-45380 is a path traversal vulnerability in bit7z, a cross-platform C++ static library used to compress and extract archive files. Versions prior to 4.0.12 contain a one-byte off-by-one error in the SafeOutPathBuilder::restoreSymlink() function. An attacker can craft a malicious .7z archive that, when extracted on any non-Windows platform, creates a symlink escaping the intended output directory. Subsequent archive entries then write arbitrary files outside the extraction directory using the permissions of the extracting process. The issue is tracked as [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory) and was fixed in version 4.0.12.

Critical Impact
A crafted .7z archive extracted by a vulnerable bit7z consumer on Linux or macOS can write arbitrary files outside the target directory, enabling tampering with application data or configuration files.

Affected Products

bit7z versions prior to 4.0.12
Non-Windows platforms (Linux, macOS, and other Unix-like systems) using bit7z for archive extraction
Applications and tooling embedding bit7z as a static library for .7z handling

Discovery Timeline

2026-06-10 - CVE-2026-45380 published to NVD
2026-06-10 - Last updated in NVD database
Patch released - bit7z version 4.0.12 published on GitHub

Technical Details for CVE-2026-45380

Vulnerability Analysis

The flaw lives in SafeOutPathBuilder::restoreSymlink(), the routine responsible for safely materializing symbolic link entries during archive extraction. A one-byte off-by-one error in this function lets an attacker bypass the path-confinement check that should restrict symlink targets to the extraction directory. Once the symlink is created, the extractor follows it for later archive entries. Those entries write file content to attacker-chosen locations on the filesystem instead of staying within the target directory.

The vulnerability only manifests on non-Windows platforms because Windows does not use POSIX-style symlink semantics in the same extraction code path. Exploitation requires the victim to extract an attacker-supplied archive, so user interaction is required. Files are written with the privileges of the process performing extraction.

Root Cause

The root cause is a boundary condition error inside the symlink restoration logic. The off-by-one allows a single byte of attacker-controlled path data to fall outside the validated buffer region used for the containment check. That byte is enough to construct a symlink whose resolved target points one directory above the extraction root, breaking the directory containment invariant.

Attack Vector

The attack is local: the victim must open or extract a crafted .7z archive with a vulnerable bit7z build on Linux or macOS. The archive contains two cooperating entries. The first entry is a symlink whose name and target exploit the off-by-one to escape the extraction directory. The second entry is a regular file whose archive path traverses through that symlink, causing its contents to be written outside the extraction root. No network access or authentication is required, but successful exploitation depends on the high-complexity precondition of triggering the off-by-one and the user choosing to extract the archive.

The vulnerability mechanism is described in the GitHub Security Advisory GHSA-8wj8-9jwv-j24v. No public proof-of-concept exploit code is available, and no synthetic code is reproduced here.

Detection Methods for CVE-2026-45380

Indicators of Compromise

Files appearing outside an application's expected bit7z extraction directory shortly after archive processing.
Symlinks within or adjacent to extraction directories whose targets resolve to parent paths such as ../, /etc, /home, or user configuration directories.
Unexpected modification of configuration files, startup scripts, or SSH authorized_keys correlated in time with .7z extraction events.

Detection Strategies

Inventory binaries and packages that statically link bit7z and identify those reporting a version below 4.0.12.
Monitor extraction worker processes on Linux and macOS hosts for symlink() and symlinkat() syscalls followed by open()/write() calls resolving outside the intended output directory.
Audit .7z archives sourced from untrusted users or systems for entries that combine symlink records with regular file entries whose paths traverse the symlink name.

Monitoring Recommendations

Enable filesystem auditing (auditd on Linux, Endpoint Security framework on macOS) on directories that host applications consuming user-supplied archives.
Alert on writes to sensitive paths (~/.ssh/, /etc/, cron directories, application config) originating from processes that handle archive extraction.
Track process lineage from extraction utilities to detect downstream execution of files written through the escape path.

How to Mitigate CVE-2026-45380

Immediate Actions Required

Upgrade bit7z to version 4.0.12 or later and rebuild all downstream applications that statically link the library.
Quarantine .7z archives received from untrusted sources until library upgrades are verified across affected hosts.
Run extraction workloads under least-privilege service accounts that cannot write to sensitive system or user directories.

Patch Information

The maintainer fixed the off-by-one in SafeOutPathBuilder::restoreSymlink() in bit7z version 4.0.12. Release notes and source are available at GitHub Release v4.0.12. Consumers must rebuild against the patched library because bit7z is distributed as a static library and is not updated transitively at runtime.

Workarounds

Restrict archive extraction to sandboxed directories using OS-level controls such as chroot, containers, or macOS App Sandbox to contain symlink escape attempts.
Pre-scan untrusted .7z archives and reject any containing symlink entries before passing them to bit7z.
Apply mandatory access controls (SELinux, AppArmor) that deny extraction processes write access to paths outside the designated output directory.

bash

# Verify the linked bit7z version in a build and reject pre-4.0.12 releases
strings ./your_app | grep -i 'bit7z' 
ldconfig -p | grep -i bit7z   # only relevant if dynamically linked

# Example AppArmor snippet limiting an extraction worker to /var/lib/app/extract
# /etc/apparmor.d/usr.local.bin.extract-worker
/var/lib/app/extract/** rw,
deny /etc/** w,
deny /home/*/.ssh/** w,