{"schema":"threatline.record/2","record":{"id":"CVE-2026-14966","aliases":["GHSA-xpf3-p7gm-7756","PYSEC-2026-3719"],"summary":"BBOT's Symlink guard bypass in unarchive module allows planting symlinks during extraction","details":"BBOT's `unarchive` module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produced by legacy versions of p7zip. Such an archive, downloaded and extracted during a scan (for example via `filedownload`), bypassed the guard and caused an attacker-controlled symlink to be written into the extraction directory. The effect is limited to planting the symlink (its target is not written through), and only hosts using such a legacy p7zip build are affected; current mainline 7-Zip is not.","categories":["Libraries & packages"],"product":"bbot","vendor":"Black Lantern Security","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-xpf3-p7gm-7756","source_modified_at":"2026-10-14T19:34:31Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"bbot"},"range":">= 2.3.1, < 3.0.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-14966","source_modified_at":"2026-07-08T15:57:12.247Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"BBOT","vendor":"Black Lantern Security","versions":[{"lessThanOrEqual":"2.8.6","status":"affected","version":"2.3.1","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-xpf3-p7gm-7756","source_modified_at":"2026-10-14T19:55:56.169306546Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"bbot","purl":"pkg:pypi/bbot"},"ranges":[{"events":[{"introduced":"2.3.1"},{"fixed":"3.0.0"}],"type":"ECOSYSTEM"}],"versions":["2.3.1","2.3.1.5815rc0","2.3.1.5818rc0","2.3.1.5820rc0","2.3.2","2.3.2.5825rc0","2.3.2.5827rc0","2.3.2.5829rc0","2.3.2.5832rc0","2.3.2.5836rc0","2.3.2.5838rc0","2.3.2.5841rc0","2.3.2.5848rc0","2.3.2.5850rc0","2.3.2.5855rc0","2.3.2.5874rc0","2.3.2.5889rc0","2.3.2.5893rc0","2.3.2.5897rc0","2.3.2.5904rc0","2.3.2.5906rc0","2.3.2.5909rc0","2.3.2.5913rc0","2.3.2.5915rc0","2.3.2.5927rc0","2.3.2.5938rc0","2.3.2.5942rc0","2.3.2.5944rc0","2.3.2.5950rc0","2.3.2.5958rc0","2.3.2.5967rc0","2.3.2.5971rc0","2.4.0","2.4.0.5974rc0","2.4.0.5977rc0","2.4.0.5984rc0","2.4.0.5986rc0","2.4.0.5988rc0","2.4.0.5992rc0","2.4.0.5995rc0","2.4.0.5997rc0","2.4.0.5999rc0","2.4.0.6005rc0","2.4.0.6007rc0","2.4.0.6031rc0","2.4.0.6037rc0","2.4.0.6039rc0","2.4.0.6045rc0","2.4.0.6050rc0","2.4.0.6067rc0"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-xpf3-p7gm-7756","source_modified_at":"2026-10-14T19:34:31Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"bbot"},"version":"3.0.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-xpf3-p7gm-7756","source_modified_at":"2026-10-14T19:55:56.169306546Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"bbot","purl":"pkg:pypi/bbot"},"version":"3.0.0"}],"cvss":3.1,"severity":"Low","kev":{"listed":false},"epss":{"probability":0.00384,"percentile":0.3124,"score_date":"2026-10-23"},"published_at":"2026-07-08T15:03:47.591Z","modified_at":"2026-10-14T19:55:56.169306546Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-xpf3-p7gm-7756","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-14T19:34:31Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-14966","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-07-08T15:57:12.247Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-xpf3-p7gm-7756","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-14T19:55:56.169306546Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-14966","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"url":"https://github.com/blacklanternsecurity/bbot/security/advisories/GHSA-xpf3-p7gm-7756","source":"GitHub Advisory Database"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14966","source":"GitHub Advisory Database"},{"url":"https://github.com/blacklanternsecurity/bbot/commit/3bc8d3a96f34f312853c9fcf8decee2a4e905f26","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/blacklanternsecurity/bbot/commit/a3f1a2292e2b0a553827c6175b761abe28807735"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/bbot/PYSEC-2026-3719.yaml","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-xpf3-p7gm-7756","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-07-08T15:57:06.003777Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-14T19:55:56.169306546Z","content_hash":"08782a8a3873dc2492fba06cfdd6ff0a1f523adecebcff44675ea4339b41edb0"}}