CVE-2026-14967
Full vulnerability record from the local CVENow database.
Description
BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve `..`, so a crafted `CODE_REPOSITORY` URL could traverse out of the intended folder. The write is bounded to two directory levels above the output location and its target is determined by the operator's configuration, not the attacker.
Severity
LOW
CVSS score
3.1
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-07-08 16:16:27.373000
Last modified
2026-10-25 20:10:00.147000
View original CVE JSON
{
"id": "CVE-2026-14967",
"sourceIdentifier": "[email protected]",
"published": "2026-07-08T16:16:27.373",
"lastModified": "2026-10-25T20:10:00.147",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve `..`, so a crafted `CODE_REPOSITORY` URL could traverse out of the intended folder. The write is bounded to two directory levels above the output location and its target is determined by the operator's configuration, not the attacker."
},
{
"lang": "es",
"value": "El módulo ’github_workflows’ de BBOT podría ser inducido a escribir un artefacto descargado fuera de su directorio de salida configurado: su verificación de contención de ruta no resolvía ’..’, por lo que una URL ’CODE_REPOSITORY’ manipulada podría salirse de la carpeta prevista. La escritura está limitada a dos niveles de directorio por encima de la ubicación de salida y su objetivo es determinado por la configuración del operador, no por el atacante."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Black Lantern Security",
"product": "BBOT",
"defaultStatus": "unaffected",
"repo": "https://github.com/blacklanternsecurity/bbot",
"versions": [
{
"version": "1.1.7",
"lessThanOrEqual": "2.8.6",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"baseScore": 3.1,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.6,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-08T15:55:49.453588Z",
"id": "CVE-2026-14967",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:*:*:*:*:*:*:*:*",
"versionStartIncluding": "1.1.7",
"versionEndIncluding": "2.8.6",
"matchCriteriaId": "38D5AC85-0219-4D8B-87E0-E920C12EC90D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.0:rc:*:*:*:*:*:*",
"matchCriteriaId": "2F3A6AFF-3346-473D-AAA4-3F0111AB9EBD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.647:rc:*:*:*:*:*:*",
"matchCriteriaId": "EA2BDC5D-35CD-4B57-B37E-A28CE2C47433"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.649:rc:*:*:*:*:*:*",
"matchCriteriaId": "36DC6598-BC77-45E4-B407-109EC915FA80"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.652:rc:*:*:*:*:*:*",
"matchCriteriaId": "E9861928-F2AF-40E0-980B-8FD15BD1BCCF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.654:rc:*:*:*:*:*:*",
"matchCriteriaId": "923C200E-B0AE-4DFE-959E-87697C074C75"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.659:rc:*:*:*:*:*:*",
"matchCriteriaId": "6D7D04DA-991C-4E05-BCA2-177CD893BE20"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.669:rc:*:*:*:*:*:*",
"matchCriteriaId": "0558C16E-B185-452F-A208-FC9044E2E7C1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.671:rc:*:*:*:*:*:*",
"matchCriteriaId": "BE3645DB-F33E-4FB6-BBBE-16842F8FB9DA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.673:rc:*:*:*:*:*:*",
"matchCriteriaId": "B4802872-6222-40CD-820B-A4F6DCE1C6A1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.691:rc:*:*:*:*:*:*",
"matchCriteriaId": "8800AC34-45B5-4327-9932-C5AAA929BAED"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.765:rc:*:*:*:*:*:*",
"matchCriteriaId": "69AFED4A-F017-492C-BB6F-5F63900741E0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.767:rc:*:*:*:*:*:*",
"matchCriteriaId": "D339840F-993B-438A-B184-4BDB3A137FCB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.773:rc:*:*:*:*:*:*",
"matchCriteriaId": "758246A4-32AD-4560-A3BA-4D8C73FDB396"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.782:rc:*:*:*:*:*:*",
"matchCriteriaId": "28CAD036-DBE2-47AF-820B-FADB5DEC206F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.786:rc:*:*:*:*:*:*",
"matchCriteriaId": "1C94FD21-589B-4346-A4E1-7A3DF82D708A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.793:rc:*:*:*:*:*:*",
"matchCriteriaId": "AB4948BA-BF91-4F72-9ED5-2D03131E2750"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.795:rc:*:*:*:*:*:*",
"matchCriteriaId": "A87C9B74-C5E9-4AAB-9C92-603E802C3D9C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.798:rc:*:*:*:*:*:*",
"matchCriteriaId": "E098337A-5163-4B9D-BD69-647D846582E5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.819:rc:*:*:*:*:*:*",
"matchCriteriaId": "3862CDE4-BA13-4BFD-8B1A-261D7326389A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.821:rc:*:*:*:*:*:*",
"matchCriteriaId": "D9D30225-DF9E-4257-869A-FD2D2B306DC8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.829:rc:*:*:*:*:*:*",
"matchCriteriaId": "6CD2E706-04C0-45D5-A28C-CC37E79AA6DE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.836:rc:*:*:*:*:*:*",
"matchCriteriaId": "DFFA2726-72E9-4899-9114-228DF3CB2EB4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.849:rc:*:*:*:*:*:*",
"matchCriteriaId": "AE6AFA4C-134A-4FD6-B80D-B0163709E534"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.851:rc:*:*:*:*:*:*",
"matchCriteriaId": "C9235727-671A-4565-B48C-63785B6BAE5F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.858:rc:*:*:*:*:*:*",
"matchCriteriaId": "2E2A4ED4-7FAF-4862-8578-236AEBFAA38D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.870:rc:*:*:*:*:*:*",
"matchCriteriaId": "3FB6A9EE-8011-4B97-A58F-C8B15F7EDD4D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.876:rc:*:*:*:*:*:*",
"matchCriteriaId": "123C6301-E7F0-440A-8828-8083F2646546"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.884:rc:*:*:*:*:*:*",
"matchCriteriaId": "7F43D321-A086-4BDB-86DB-95E5145584D3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.897:rc:*:*:*:*:*:*",
"matchCriteriaId": "0F7F112B-260F-4E75-94EA-D5277B954905"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.903:rc:*:*:*:*:*:*",
"matchCriteriaId": "84C715DE-766D-4B12-9310-45EDDDE3D782"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.907:rc:*:*:*:*:*:*",
"matchCriteriaId": "A97B703D-55A8-47FB-BF04-42E30F32B4D7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.909:rc:*:*:*:*:*:*",
"matchCriteriaId": "AFC609E0-F13A-4C44-AF96-2C06FA5D594C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.981:rc:*:*:*:*:*:*",
"matchCriteriaId": "9073CCA9-F1F1-4503-A1F8-DECBC6478808"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.986:rc:*:*:*:*:*:*",
"matchCriteriaId": "45E2BC4C-8CF2-472B-9AAB-CB356DEE1AFC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1056:rc:*:*:*:*:*:*",
"matchCriteriaId": "FFE4351D-5E93-428E-9CEB-5AF48EA2FDD6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1062:rc:*:*:*:*:*:*",
"matchCriteriaId": "950D0358-935D-4417-AAC3-3CD431E02C83"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1064:rc:*:*:*:*:*:*",
"matchCriteriaId": "BE97FBD6-ECDD-4E17-B529-FCADB6A636DB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1068:rc:*:*:*:*:*:*",
"matchCriteriaId": "072DC050-3858-4999-8B0A-7192B5D15328"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1070:rc:*:*:*:*:*:*",
"matchCriteriaId": "77273947-6CF8-404A-905E-6F24832E8C7A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1079:rc:*:*:*:*:*:*",
"matchCriteriaId": "2C2B9E92-6911-420D-AD09-CC1E6197FD2E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1137:rc:*:*:*:*:*:*",
"matchCriteriaId": "DB3341D0-CD73-417C-BA71-59ED3ECD3833"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1139:rc:*:*:*:*:*:*",
"matchCriteriaId": "E26B5EE1-CF42-4514-B725-A560578B225E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1141:rc:*:*:*:*:*:*",
"matchCriteriaId": "F2B5FD56-11D8-4843-8AFE-54A5B719C621"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1153:rc:*:*:*:*:*:*",
"matchCriteriaId": "A4533066-A188-4C7A-A7E1-A18DAA647E84"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1173:rc:*:*:*:*:*:*",
"matchCriteriaId": "D2DC5A98-0A59-4141-87C3-F1BD39C1AC98"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1184:rc:*:*:*:*:*:*",
"matchCriteriaId": "F38D08F8-8CED-4D59-BAEE-8C47A280DC02"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1190:rc:*:*:*:*:*:*",
"matchCriteriaId": "B607C3F9-FCC2-4499-93FA-09803B092D94"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1254:rc:*:*:*:*:*:*",
"matchCriteriaId": "D59857F2-EEFC-4235-993C-2DD333E88522"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1271:rc:*:*:*:*:*:*",
"matchCriteriaId": "A358D778-4FA0-487B-8BD0-481419E968E7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1274:rc:*:*:*:*:*:*",
"matchCriteriaId": "CBE4E534-BB85-4E56-9527-FC5830224908"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1304:rc:*:*:*:*:*:*",
"matchCriteriaId": "03D64FE9-A7B0-4647-BB18-9443D0007EC2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1313:rc:*:*:*:*:*:*",
"matchCriteriaId": "883605D2-7A3E-4535-9D38-17213FA6E801"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1317:rc:*:*:*:*:*:*",
"matchCriteriaId": "70EFAD5D-DDA3-4994-B201-84D34551E473"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1333:rc:*:*:*:*:*:*",
"matchCriteriaId": "E83F656A-2C9D-438C-A06A-CA56CFD51436"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1343:rc:*:*:*:*:*:*",
"matchCriteriaId": "FE58D8D1-DDC0-433E-9F8B-ABB3056084B7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1345:rc:*:*:*:*:*:*",
"matchCriteriaId": "BBA5DE37-5716-4542-811E-7F6B621D5BCB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1349:rc:*:*:*:*:*:*",
"matchCriteriaId": "3F92D1F4-B1C3-4561-BA6B-9D8CD1F2041D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1386:rc:*:*:*:*:*:*",
"matchCriteriaId": "5B23090F-EAD5-4993-BFEE-425F8B2EE14D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1388:rc:*:*:*:*:*:*",
"matchCriteriaId": "136B97A3-491C-4F22-84E9-86A6C4C9F068"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1390:rc:*:*:*:*:*:*",
"matchCriteriaId": "E96A4ABB-56AC-4343-ADB7-71D1A53F025D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1401:rc:*:*:*:*:*:*",
"matchCriteriaId": "670CA1D0-BB77-4195-9E35-6BF3FB36492D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1407:rc:*:*:*:*:*:*",
"matchCriteriaId": "4390C586-2C7F-4B50-93F9-29E48830DBF7"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/blacklanternsecurity/bbot/commit/c1c6ec05ff998e2fba55a14d1026f12563ccd82f",
"source": "[email protected]",
"tags": [
"Patch"
]
}
]
}