CVE-2026-27117

CVE-2026-27117 is a path traversal vulnerability (Zip Slip) in the bit7z C++ library, affecting versions prior to 4.0.11, which allows attackers to write files outside the intended extraction directory. This high-severity vulnerability (CVSS 7.5) can be exploited remotely without authentication, leading to arbitrary file write and potential overwriting of critical system files. While there is no evidence of active exploitation, public exploit code, or significant community discussion, the potential for impact on applications using bit7z to extract untrusted archives is significant. Organizations are advised to upgrade to version 4.0.11 or implement mitigation strategies such as path validation and sandboxed extraction.