bit7z is a C++ static library for handling archive files. A path traversal flaw, also called Zip Slip, exists in versions before 4.0.11. The library fails to validate paths in archive entries, allowing an attacker to create relative, absolute, or symbolic‑link paths that cause files to be written outside the target extraction directory. The result is arbitrary overwrite of any file the process can reach, which can modify application binaries, configuration files, or other sensitive data. The vulnerability does not grant direct file read access; any confidentiality risk arises only from how the calling application later uses or displays the extracted files, such as via symlinked content.

The flaw affects all installations of the rikyoz bit7z library version 4.0.10 and earlier, regardless of the operating system, including any custom applications that embed the library to extract archives. The specific update that removes the issue is version 4.0.11.

The score of 5.5 indicates a medium‑severity risk. Based on the description, it is inferred that the likely attack vector is an attacker supplying a crafted archive to an application that uses bit7z; this is typically possible in services that accept user‑uploaded archives. The EPSS value of less than 1% suggests a low probability of observed exploitation, and the flaw is not listed in the CISA KEV catalog. However, successful exploitation results in file write with the process’s privileges, allowing potential modification of critical system or application files. The absence of input validation remains the core weakness identified by CWE‑22, CWE‑23, and CWE‑36.