CVE-2026-45384CWE-377CWE-59

bit7z: Arbitrary File Overwrite via Symlink Attack on Predictable Temp File During Archive Update

Medium · published June 10, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
5.8
In the wild
Unconfirmed
What it is

bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.12, there is an arbitrary file overwrite vulnerability via symlink attack on predictable temp files during archive update. This issue has been patched in version 4.0.12.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00168 · 5.8th percentile
Weaknesses
CWE-377 · Insecure Temporary File; CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2026-06-10T20:00Z
EPSS history
Timeline
  • 10 JUN 20:00Z
    bit7z: Arbitrary File Overwrite via Symlink Attack on Predictable Temp File During Archive Update
    cvelistv5