CVE-2026-14966
Full vulnerability record from the local CVENow database.
Description
BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produced by legacy versions of p7zip. Such an archive, downloaded and extracted during a scan (for example via filedownload), bypassed the guard and caused an attacker-controlled symlink to be written into the extraction directory. The effect is limited to planting the symlink (its target is not written through), and only hosts using such a legacy p7zip build are affected; current mainline 7-Zip is not.
Severity
LOW
CVSS score
3.1
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-07-08 16:16:27.237000
Last modified
2026-10-25 20:10:00.147000
View original CVE JSON
{
"id": "CVE-2026-14966",
"sourceIdentifier": "[email protected]",
"published": "2026-07-08T16:16:27.237",
"lastModified": "2026-10-25T20:10:00.147",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produced by legacy versions of p7zip. Such an archive, downloaded and extracted during a scan (for example via filedownload), bypassed the guard and caused an attacker-controlled symlink to be written into the extraction directory. The effect is limited to planting the symlink (its target is not written through), and only hosts using such a legacy p7zip build are affected; current mainline 7-Zip is not."
},
{
"lang": "es",
"value": "El módulo de desarchivado de BBOT rechaza archivos que contienen entradas de enlaces simbólicos antes de la extracción, pero para archivos zip y 7z no logró detectar enlaces simbólicos cuyo listado lleva un prefijo de atributo DoS antes del modo Unix, como los producidos por versiones antiguas de p7zip. Dicho archivo, descargado y extraído durante un escaneo (por ejemplo, a través de filedownload), eludió la protección y provocó que un enlace simbólico controlado por el atacante se escribiera en el directorio de extracción. El efecto se limita a la creación del enlace simbólico (su destino no se escribe a través de él), y solo los hosts que utilizan una compilación antigua de p7zip se ven afectados; la versión principal actual de 7-Zip no lo está."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Black Lantern Security",
"product": "BBOT",
"defaultStatus": "unaffected",
"repo": "https://github.com/blacklanternsecurity/bbot",
"versions": [
{
"version": "2.3.1",
"lessThanOrEqual": "2.8.6",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"baseScore": 3.1,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.6,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-08T15:57:06.003777Z",
"id": "CVE-2026-14966",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-59"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.3.1",
"versionEndIncluding": "2.8.6",
"matchCriteriaId": "9B9815D5-E02F-4EB5-8660-BE0D08598504"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.0:rc:*:*:*:*:*:*",
"matchCriteriaId": "2F3A6AFF-3346-473D-AAA4-3F0111AB9EBD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.647:rc:*:*:*:*:*:*",
"matchCriteriaId": "EA2BDC5D-35CD-4B57-B37E-A28CE2C47433"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.649:rc:*:*:*:*:*:*",
"matchCriteriaId": "36DC6598-BC77-45E4-B407-109EC915FA80"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.652:rc:*:*:*:*:*:*",
"matchCriteriaId": "E9861928-F2AF-40E0-980B-8FD15BD1BCCF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.654:rc:*:*:*:*:*:*",
"matchCriteriaId": "923C200E-B0AE-4DFE-959E-87697C074C75"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.659:rc:*:*:*:*:*:*",
"matchCriteriaId": "6D7D04DA-991C-4E05-BCA2-177CD893BE20"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.669:rc:*:*:*:*:*:*",
"matchCriteriaId": "0558C16E-B185-452F-A208-FC9044E2E7C1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.671:rc:*:*:*:*:*:*",
"matchCriteriaId": "BE3645DB-F33E-4FB6-BBBE-16842F8FB9DA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.673:rc:*:*:*:*:*:*",
"matchCriteriaId": "B4802872-6222-40CD-820B-A4F6DCE1C6A1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.691:rc:*:*:*:*:*:*",
"matchCriteriaId": "8800AC34-45B5-4327-9932-C5AAA929BAED"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.765:rc:*:*:*:*:*:*",
"matchCriteriaId": "69AFED4A-F017-492C-BB6F-5F63900741E0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.767:rc:*:*:*:*:*:*",
"matchCriteriaId": "D339840F-993B-438A-B184-4BDB3A137FCB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.773:rc:*:*:*:*:*:*",
"matchCriteriaId": "758246A4-32AD-4560-A3BA-4D8C73FDB396"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.782:rc:*:*:*:*:*:*",
"matchCriteriaId": "28CAD036-DBE2-47AF-820B-FADB5DEC206F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.786:rc:*:*:*:*:*:*",
"matchCriteriaId": "1C94FD21-589B-4346-A4E1-7A3DF82D708A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.793:rc:*:*:*:*:*:*",
"matchCriteriaId": "AB4948BA-BF91-4F72-9ED5-2D03131E2750"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.795:rc:*:*:*:*:*:*",
"matchCriteriaId": "A87C9B74-C5E9-4AAB-9C92-603E802C3D9C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.798:rc:*:*:*:*:*:*",
"matchCriteriaId": "E098337A-5163-4B9D-BD69-647D846582E5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.819:rc:*:*:*:*:*:*",
"matchCriteriaId": "3862CDE4-BA13-4BFD-8B1A-261D7326389A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.821:rc:*:*:*:*:*:*",
"matchCriteriaId": "D9D30225-DF9E-4257-869A-FD2D2B306DC8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.829:rc:*:*:*:*:*:*",
"matchCriteriaId": "6CD2E706-04C0-45D5-A28C-CC37E79AA6DE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.836:rc:*:*:*:*:*:*",
"matchCriteriaId": "DFFA2726-72E9-4899-9114-228DF3CB2EB4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.849:rc:*:*:*:*:*:*",
"matchCriteriaId": "AE6AFA4C-134A-4FD6-B80D-B0163709E534"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.851:rc:*:*:*:*:*:*",
"matchCriteriaId": "C9235727-671A-4565-B48C-63785B6BAE5F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.858:rc:*:*:*:*:*:*",
"matchCriteriaId": "2E2A4ED4-7FAF-4862-8578-236AEBFAA38D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.870:rc:*:*:*:*:*:*",
"matchCriteriaId": "3FB6A9EE-8011-4B97-A58F-C8B15F7EDD4D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.876:rc:*:*:*:*:*:*",
"matchCriteriaId": "123C6301-E7F0-440A-8828-8083F2646546"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.884:rc:*:*:*:*:*:*",
"matchCriteriaId": "7F43D321-A086-4BDB-86DB-95E5145584D3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.897:rc:*:*:*:*:*:*",
"matchCriteriaId": "0F7F112B-260F-4E75-94EA-D5277B954905"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.903:rc:*:*:*:*:*:*",
"matchCriteriaId": "84C715DE-766D-4B12-9310-45EDDDE3D782"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.907:rc:*:*:*:*:*:*",
"matchCriteriaId": "A97B703D-55A8-47FB-BF04-42E30F32B4D7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.909:rc:*:*:*:*:*:*",
"matchCriteriaId": "AFC609E0-F13A-4C44-AF96-2C06FA5D594C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.981:rc:*:*:*:*:*:*",
"matchCriteriaId": "9073CCA9-F1F1-4503-A1F8-DECBC6478808"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.986:rc:*:*:*:*:*:*",
"matchCriteriaId": "45E2BC4C-8CF2-472B-9AAB-CB356DEE1AFC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1056:rc:*:*:*:*:*:*",
"matchCriteriaId": "FFE4351D-5E93-428E-9CEB-5AF48EA2FDD6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1062:rc:*:*:*:*:*:*",
"matchCriteriaId": "950D0358-935D-4417-AAC3-3CD431E02C83"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1064:rc:*:*:*:*:*:*",
"matchCriteriaId": "BE97FBD6-ECDD-4E17-B529-FCADB6A636DB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1068:rc:*:*:*:*:*:*",
"matchCriteriaId": "072DC050-3858-4999-8B0A-7192B5D15328"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1070:rc:*:*:*:*:*:*",
"matchCriteriaId": "77273947-6CF8-404A-905E-6F24832E8C7A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1079:rc:*:*:*:*:*:*",
"matchCriteriaId": "2C2B9E92-6911-420D-AD09-CC1E6197FD2E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1137:rc:*:*:*:*:*:*",
"matchCriteriaId": "DB3341D0-CD73-417C-BA71-59ED3ECD3833"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1139:rc:*:*:*:*:*:*",
"matchCriteriaId": "E26B5EE1-CF42-4514-B725-A560578B225E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1141:rc:*:*:*:*:*:*",
"matchCriteriaId": "F2B5FD56-11D8-4843-8AFE-54A5B719C621"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1153:rc:*:*:*:*:*:*",
"matchCriteriaId": "A4533066-A188-4C7A-A7E1-A18DAA647E84"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1173:rc:*:*:*:*:*:*",
"matchCriteriaId": "D2DC5A98-0A59-4141-87C3-F1BD39C1AC98"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1184:rc:*:*:*:*:*:*",
"matchCriteriaId": "F38D08F8-8CED-4D59-BAEE-8C47A280DC02"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1190:rc:*:*:*:*:*:*",
"matchCriteriaId": "B607C3F9-FCC2-4499-93FA-09803B092D94"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1254:rc:*:*:*:*:*:*",
"matchCriteriaId": "D59857F2-EEFC-4235-993C-2DD333E88522"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1271:rc:*:*:*:*:*:*",
"matchCriteriaId": "A358D778-4FA0-487B-8BD0-481419E968E7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1274:rc:*:*:*:*:*:*",
"matchCriteriaId": "CBE4E534-BB85-4E56-9527-FC5830224908"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1304:rc:*:*:*:*:*:*",
"matchCriteriaId": "03D64FE9-A7B0-4647-BB18-9443D0007EC2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1313:rc:*:*:*:*:*:*",
"matchCriteriaId": "883605D2-7A3E-4535-9D38-17213FA6E801"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1317:rc:*:*:*:*:*:*",
"matchCriteriaId": "70EFAD5D-DDA3-4994-B201-84D34551E473"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1333:rc:*:*:*:*:*:*",
"matchCriteriaId": "E83F656A-2C9D-438C-A06A-CA56CFD51436"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1343:rc:*:*:*:*:*:*",
"matchCriteriaId": "FE58D8D1-DDC0-433E-9F8B-ABB3056084B7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1345:rc:*:*:*:*:*:*",
"matchCriteriaId": "BBA5DE37-5716-4542-811E-7F6B621D5BCB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1349:rc:*:*:*:*:*:*",
"matchCriteriaId": "3F92D1F4-B1C3-4561-BA6B-9D8CD1F2041D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1386:rc:*:*:*:*:*:*",
"matchCriteriaId": "5B23090F-EAD5-4993-BFEE-425F8B2EE14D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1388:rc:*:*:*:*:*:*",
"matchCriteriaId": "136B97A3-491C-4F22-84E9-86A6C4C9F068"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1390:rc:*:*:*:*:*:*",
"matchCriteriaId": "E96A4ABB-56AC-4343-ADB7-71D1A53F025D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1401:rc:*:*:*:*:*:*",
"matchCriteriaId": "670CA1D0-BB77-4195-9E35-6BF3FB36492D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1407:rc:*:*:*:*:*:*",
"matchCriteriaId": "4390C586-2C7F-4B50-93F9-29E48830DBF7"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/blacklanternsecurity/bbot/commit/a3f1a2292e2b0a553827c6175b761abe28807735",
"source": "[email protected]",
"tags": [
"Patch"
]
}
]
}