CVE-2026-27117 - Vulnerability Analysis

Overview

bit7z < 4.0.11 contains a path traversal vulnerability caused by inadequate validation of archive entry file paths, letting attackers write files outside the extraction directory, exploit requires malicious archive input.

Severity & Score

Impact

Attackers can write arbitrary files with process privileges, potentially overwriting binaries or sensitive data, leading to system compromise or data loss.

Mitigation

Upgrade to version 4.0.11 or later.

References

• https://github.com/rikyoz/bit7z/security/advisories/GHSA-qvjh-hhw4-3gx9
• https://github.com/rikyoz/bit7z/commit/31763da9a3e41a199c141c8d71f6c11de24b45cf
• https://github.com/rikyoz/bit7z/commit/9e020483eefa5825ec9310b1d869933d4f77f969
• https://github.com/rikyoz/bit7z/releases/tag/v4.0.11

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner