What’s Vulnerable › Vulnerabilities
CVE-2026-14966: Symlink guard bypass in unarchive module allows planting symlinks during extraction
- Severity: low (CVSS 3.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-08 · updated 2026-10-25
- Weakness: CWE-59
Description
BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produced by legacy versions of p7zip. Such an archive, downloaded and extracted during a scan (for example via filedownload), bypassed the guard and caused an attacker-controlled symlink to be written into the extraction directory. The effect is limited to planting the symlink (its target is not written through), and only hosts using such a legacy p7zip build are affected; current mainline 7-Zip is not.
Affected products
- Black Lantern Security BBOT: from 2.3.1 through 2.8.6; 3.0.0.0-rc, 3.0.0.647-rc, 3.0.0.649-rc, 3.0.0.652-rc, 3.0.0.654-rc, 3.0.0.659-rc (+56)
References
Get alerted when CVE-2026-14966 or the next vulnerability affects your stack