LOW 3.1 GitHub
CVE-2026-14966
BBOT's Symlink guard bypass in unarchive module allows planting symlinks during extraction
BBOT's `unarchive` module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produced by legacy versions of p7zip. Such an archive, downloaded and extracted during a scan (for example via `filedownload`), bypassed the guard and caused an attacker-controlled symlink to be written into the extraction directory. The effect is limited to planting the symlink (its
Affected Products
- pip/bbot >= 2.3.1, < 3.0.0
References
- https://github.com/advisories/GHSA-xpf3-p7gm-7756
- https://github.com/blacklanternsecurity/bbot/security/advisories/GHSA-xpf3-p7gm-7756
- https://nvd.nist.gov/vuln/detail/CVE-2026-14966
- https://github.com/blacklanternsecurity/bbot/commit/3bc8d3a96f34f312853c9fcf8decee2a4e905f
This low severity vulnerability with a CVSS score of 3.1 was published on 2026-10-14 via GitHub. Affected: pip/bbot >= 2.3.1, < 3.0.0.
vulnfeed aggregates 15189 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.