Executive brief
bit7z is a C++ library used by developers to add file compression and extraction capabilities (like .7z files) to their applications. A security flaw in how the library handles symbolic links allows a malicious archive to write files outside of the intended folder during extraction. This could allow an attacker to overwrite sensitive configuration files or place malicious scripts on a user's system if they are tricked into extracting a specially crafted archive.
Technical details
An off-by-one error exists in `SafeOutPathBuilder::restoreSymlink()` due to improper use of `std::istream::gcount()`. When reading a symlink target from an archive, the library includes the newline delimiter in the character count, resulting in a null byte being embedded at the end of the target path string (e.g., "..\0"). While C++ lexical validation treats this as a safe internal path, POSIX system calls like `symlink()` truncate the string at the null byte, creating a link to the parent directory (".."). Subsequent files in the archive can then be extracted through this symlink to write data outside the intended base directory. This vulnerability affects non-Windows platforms and is fixed in version 4.0.12.
Affected products
- rikyoz bit7z < 4.0.12
Timeline
- 2026-05-15: patched: Fixed in version 4.0.12
- 2026-06-10: disclosed: CVE-2026-45380 published