Executive brief
bit7z is a C++ library used by applications to create and extract compressed archives (like ZIP or 7z files). A security flaw allows a local attacker to trick the library into overwriting important system or user files when an archive is being updated. This could lead to permanent data loss or, in some cases, allow an attacker to gain unauthorized access to a user's account by injecting malicious configuration data.
Technical details
An arbitrary file overwrite vulnerability exists in bit7z's archive update mechanism. When `BitOutputArchive::compressToFile()` performs an in-place update, it creates a temporary file with a predictable name (`<archive_path>.tmp`) using `std::ofstream::open()` with `std::ios::trunc`. On POSIX systems, this operation follows symbolic links without `O_NOFOLLOW` protections. A local attacker with write access to the directory containing the archive can pre-place a symlink at the predictable temporary path pointing to a target file owned by the victim. When the library updates the archive, it follows the symlink and overwrites the target file with archive data. If the TAR format is used, attackers can inject specific payloads (like SSH keys) into system files because TAR stores data uncompressed. The issue is fixed in version 4.0.12 by using `mkdtemp` on POSIX and improved file existence checks on Windows.
Affected products
- rikyoz bit7z <= 4.0.11
Timeline
- 2026-05-15: patched: Version 4.0.12 released
- 2026-06-10: disclosed: CVE-2026-45384 published