CVE-2026-45380

Name of the Vulnerable Software and Affected Versions bit7z versions prior to 4.0.12

Description A one-byte off-by-one error in the SafeOutPathBuilder::restoreSymlink() function allows an attacker to create a specially crafted .7z archive. When extracted on non-Windows platforms, this can result in the creation of a symlink that escapes the intended output directory. Consequently, subsequent archive entries can be used to write arbitrary files outside the extraction directory using the permissions of the process performing the extraction.

Recommendations Update to version 4.0.12.