vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-14966

Symlink guard bypass in unarchive module allows planting symlinks during extraction

LOW
3.1
CVSS Score
Published: July 8, 2026 at 03:03 PM UTC
Updated: October 25, 2026 at 08:10 PM UTC
1 product affected across 1 vendorBBOT

Using BBOT by Black Lantern Security?

Get instant alerts when new vulnerabilities affect BBOT - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
LOW3.1
Exploit prediction
EPSS 0.4%
SSVC
No known exploit

Description

BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produced by legacy versions of p7zip. Such an archive, downloaded and extracted during a scan (for example via filedownload), bypassed the guard and caused an attacker-controlled symlink to be written into the extraction directory. The effect is limited to planting the symlink (its target is not written through), and only hosts using such a legacy p7zip build are affected; current mainline 7-Zip is not.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

BBOT· Blacklanternsecurity
95%
2.3.1 ≤ v ≤ 2.8.62.3.13.0.0.03.0.0.0 rc3.0.0.10563.0.0.1056 rc3.0.0.10623.0.0.1062 rc3.0.0.10643.0.0.1064 rc3.0.0.10683.0.0.1068 rc3.0.0.10703.0.0.1070 rc3.0.0.10793.0.0.1079 rc3.0.0.11373.0.0.1137 rc3.0.0.11393.0.0.1139 rc3.0.0.11413.0.0.1141 rc3.0.0.11533.0.0.1153 rc3.0.0.11733.0.0.1173 rc3.0.0.11843.0.0.1184 rc3.0.0.11903.0.0.1190 rc3.0.0.12543.0.0.1254 rc3.0.0.12713.0.0.1271 rc3.0.0.12743.0.0.1274 rc3.0.0.13043.0.0.1304 rc3.0.0.13133.0.0.1313 rc3.0.0.13173.0.0.1317 rc3.0.0.13333.0.0.1333 rc3.0.0.13433.0.0.1343 rc3.0.0.13453.0.0.1345 rc3.0.0.13493.0.0.1349 rc3.0.0.13863.0.0.1386 rc3.0.0.13883.0.0.1388 rc3.0.0.13903.0.0.1390 rc3.0.0.14013.0.0.1401 rc3.0.0.14073.0.0.1407 rc3.0.0.6473.0.0.647 rc3.0.0.6493.0.0.649 rc3.0.0.6523.0.0.652 rc3.0.0.6543.0.0.654 rc3.0.0.6593.0.0.659 rc3.0.0.6693.0.0.669 rc3.0.0.6713.0.0.671 rc3.0.0.6733.0.0.673 rc3.0.0.6913.0.0.691 rc3.0.0.7653.0.0.765 rc3.0.0.7673.0.0.767 rc3.0.0.7733.0.0.773 rc3.0.0.7823.0.0.782 rc3.0.0.7863.0.0.786 rc3.0.0.7933.0.0.793 rc3.0.0.7953.0.0.795 rc3.0.0.7983.0.0.798 rc3.0.0.8193.0.0.819 rc3.0.0.8213.0.0.821 rc3.0.0.8293.0.0.829 rc3.0.0.8363.0.0.836 rc3.0.0.8493.0.0.849 rc3.0.0.8513.0.0.851 rc3.0.0.8583.0.0.858 rc3.0.0.8703.0.0.870 rc3.0.0.8763.0.0.876 rc3.0.0.8843.0.0.884 rc3.0.0.8973.0.0.897 rc3.0.0.9033.0.0.903 rc3.0.0.9073.0.0.907 rc3.0.0.9093.0.0.909 rc3.0.0.9813.0.0.981 rc3.0.0.9863.0.0.986 rc

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (1)

Patch
Source: cverecord
https://github.com/blacklanternsecurity/bbot/commit/a3f1a2292e2b0a553827c6175b761abe28807735

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

3.1LOWBLSOPS
Attack Vector
NETWORK
Complexity
HIGH
Privileges
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE
Vector?

Quick Info

StatusANALYZED
CWE
CWE-59

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card