CVE-2026-45384 Details

A vulnerability allowing arbitrary file overwrites has been identified in bit7z, a cross-platform C++ static library for compressing and extracting archive files. This issue exists in versions prior to 4.0.12 and arises from a symlink attack on predictable temporary files during archive updates. When the library updates an archive, it writes to a temporary file with a known name, which can be intercepted by an attacker with write access to the archive directory. By placing a symlink pointing to a target file at the temporary file's location, the library inadvertently overwrites the target file with archive data. This vulnerability is particularly concerning when the archive format is TAR, as it allows for the injection of SSH keys into the authorized_keys file, granting unauthorized access.

Users are advised to update to bit7z version 4.0.12, which addresses this vulnerability by changing how temporary files are handled during archive updates. The new version eliminates the predictability of temporary file names and prevents symlinks from being followed, thereby closing the window for this type of attack.