CVE-2026-45384: bit7z Path Traversal Vulnerability

CVE-2026-45384 Overview

CVE-2026-45384 is an arbitrary file overwrite vulnerability in bit7z, a cross-platform C++ static library that wraps the 7-Zip SDK for archive compression and extraction. Versions prior to 4.0.12 create predictable temporary files during archive update operations. A local attacker can pre-create a symbolic link at the anticipated temp file path, causing bit7z to follow the link and overwrite an arbitrary file with the privileges of the process using the library. The maintainer patched the issue in version 4.0.12. This weakness is categorized under CWE-59: Improper Link Resolution Before File Access.

Critical Impact
Local attackers can overwrite arbitrary files writable by the target process, enabling integrity loss and limited denial of service against applications embedding bit7z.

Affected Products

bit7z versions prior to 4.0.12
Applications statically linking vulnerable bit7z releases
Multi-platform deployments (Windows, Linux, macOS) using bit7z archive update APIs

Discovery Timeline

2026-06-10 - CVE-2026-45384 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-45384

Vulnerability Analysis

The vulnerability resides in the archive update workflow of bit7z. When updating an existing archive, the library writes intermediate state to a temporary file whose name is predictable, rather than randomized through a secure mkstemp-style primitive. The library opens and writes the temp path without verifying that the destination is a regular file owned by the current process. On systems where the temp directory is shared, an unprivileged local attacker can place a symbolic link at the predicted path pointing to a sensitive target file. When bit7z proceeds with the update, the write follows the symlink and corrupts or replaces the target file. The flaw maps to [CWE-59] and reflects a classic TOCTOU-adjacent symlink-following pattern in temporary file handling.

Root Cause

The root cause is twofold: temporary file paths are generated deterministically, and the file is opened without O_NOFOLLOW semantics or equivalent symlink-safe creation flags. The combination allows an attacker who can predict the path to redirect the I/O target before bit7z opens the file.

Attack Vector

Exploitation requires local access and the ability to write into the temporary directory used by the process invoking bit7z. The attacker pre-positions a symlink at the predicted temp path, waits for an archive update operation, and the host process writes attacker-chosen content into an arbitrary file. No user interaction is required beyond the normal archive update workflow. See the GitHub Security Advisory GHSA-wjch-42rm-q53h for advisory details and the GitHub Release v4.0.12 for the patched build.

Detection Methods for CVE-2026-45384

Indicators of Compromise

Symbolic links present in shared temp directories pointing to sensitive files such as configuration, credential, or binary paths
Unexpected modification timestamps on system files coinciding with archive update activity by applications using bit7z
Process telemetry showing bit7z-linked applications writing outside their normal working directories

Detection Strategies

Inventory binaries that statically link bit7z and identify versions below 4.0.12
Audit filesystem events for symlink creations in /tmp, %TEMP%, or other shared temp paths immediately preceding archive operations
Correlate file integrity monitoring alerts on sensitive files with execution of archive-handling processes

Monitoring Recommendations

Enable file integrity monitoring on configuration directories, service binaries, and credential stores
Log and alert on open() and CreateFile calls that traverse symlinks in world-writable directories
Track build manifests and SBOMs to flag new builds that ship pre-4.0.12 versions of bit7z

How to Mitigate CVE-2026-45384

Immediate Actions Required

Upgrade bit7z to version 4.0.12 or later and rebuild all dependent applications
Identify every binary embedding bit7z through SBOM review and prioritize multi-user systems for patching
Restrict write access to temporary directories used by services running with elevated privileges

Patch Information

The maintainer addressed the symlink-following behavior in bit7z version 4.0.12. Consumers must update the dependency, recompile, and redistribute the affected applications. Refer to the GitHub Release v4.0.12 notes for the full change set.

Workarounds

Configure the embedding application to use a per-user, mode 0700 temporary directory instead of a shared system temp path
Run archive update operations under a dedicated low-privilege account with no write access to sensitive files
Apply mandatory access controls (AppArmor, SELinux) to confine bit7z-using processes to their working directories

bash

# Configuration example: isolate temp directory for bit7z consumers
install -d -m 0700 -o appuser -g appuser /var/lib/myapp/tmp
export TMPDIR=/var/lib/myapp/tmp
systemctl set-environment TMPDIR=/var/lib/myapp/tmp