CVE-2026-14966: BBOT Path Traversal Vulnerability

CVE-2026-14966 Overview

CVE-2026-14966 is a symlink handling flaw [CWE-59] in the unarchive module of BBOT (Bighuge BLS OSINT Tool). The module rejects archives that contain symlink entries before extraction. For zip and 7z archives, the guard failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode string, a format produced by legacy versions of p7zip. An attacker-supplied archive downloaded during a scan bypassed the guard and planted an attacker-controlled symlink in the extraction directory. The symlink target is not written through, so the impact is limited to symlink creation. Only hosts running affected legacy p7zip builds are exposed; current mainline 7-Zip is not.

Critical Impact
Attackers hosting a crafted archive can plant a symlink in the BBOT extraction directory when the target host uses legacy p7zip. Exploitation requires user interaction and a high-complexity attack chain.

Affected Products

BBOT (Bighuge BLS OSINT Tool) unarchive internal module
Hosts running legacy p7zip builds that emit DOS-attribute prefixes before unix mode strings
BBOT scans that fetch remote archives (for example through the filedownload module)

Discovery Timeline

2026-07-08 - CVE-2026-14966 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-14966

Vulnerability Analysis

BBOT's unarchive module inspects archive listings from 7z l before extraction and refuses archives containing symlink or hardlink entries. The pre-patch check parsed each Attributes = line and treated the value as a unix mode string, flagging entries beginning with l. Legacy p7zip builds emit a DOS-attribute block ahead of the unix mode, producing lines such as Attributes = _ lrwxrwxrwx. The leading _ prevented the substring test from matching the l type flag, so the guard passed and extraction proceeded. The extractor then honored the symlink entry and wrote it into the target directory.

Root Cause

The validation logic assumed a single canonical output format from 7z l. It only inspected the first character of the raw attributes value, ignoring the possibility that p7zip may prepend a DOS-attribute field before the unix mode string. This is a classic parser assumption failure where the security decision depends on tool-specific output formatting.

Attack Vector

An attacker hosts a crafted zip or 7z archive containing a symlink entry whose listing renders with the DOS-attribute prefix under legacy p7zip. During a BBOT scan, the filedownload workflow retrieves the archive, and the unarchive module extracts it. The symlink is written to the extraction directory pointing at an attacker-chosen path. The archive contents are not written through the symlink, so this vulnerability plants a link without directly modifying the target.

python

             entries = entries[1:]
             # reject symlink/hardlink entries
             for line in output_lines:
-                if line.startswith("Link = ") or (
-                    line.startswith("Attributes = ") and line.split("= ", 1)[1].strip().startswith("l")
-                ):
+                if line.startswith("Link = "):
                     self.warning(f"Archive {path} contains symlink or link entry")
                     return False
+                if line.startswith("Attributes = "):
+                    attr = line.split("= ", 1)[1].strip()
+                    # p7zip may prefix a DOS attribute block before the unix mode string,
+                    # e.g. "_ lrwxrwxrwx" for a symlink or "D drwxr-xr-x" for a directory.
+                    # The unix type flag is the first character of the mode field, so check
+                    # both the raw value and the trailing mode field for "l"/"h".
+                    mode = attr.split()[-1] if attr.split() else ""
+                    if attr[:1] in ("l", "h") or mode[:1] in ("l", "h"):
+                        self.warning(f"Archive {path} contains symlink or link entry")
+                        return False
             # check declared uncompressed size before extracting
             declared_size = 0
             for line in output_lines:

Source: BBOT security patch commit

Detection Methods for CVE-2026-14966

Indicators of Compromise

Unexpected symlink files appearing inside BBOT extraction working directories after filedownload activity.
BBOT logs referencing archives that were extracted without emitting the contains symlink or link entry warning while the extraction directory nonetheless contains symlinks.
Presence of legacy p7zip binaries on hosts running BBOT scans, especially versions that render DOS-attribute prefixes such as _ lrwxrwxrwx in 7z l output.

Detection Strategies

Audit 7z l output on BBOT hosts against representative test archives to confirm whether attribute lines carry a DOS-attribute prefix.
Monitor filesystem creations in BBOT scratch and extraction paths for new symlinks whose targets fall outside the extraction root.
Correlate scan logs with archive download events to identify sessions where remote content was extracted without symlink warnings.

Monitoring Recommendations

Enable filesystem auditing (for example auditd watches) on BBOT extraction directories to record symlink and symlinkat syscalls.
Ship BBOT stdout and stderr to a central logging platform and alert on missing rejection warnings paired with symlink creation events.
Track the installed p7zip version across scan hosts and flag legacy builds for remediation.

How to Mitigate CVE-2026-14966

Immediate Actions Required

Update BBOT to a build that includes commit a3f1a2292e2b0a553827c6175b761abe28807735, which extends the symlink and hardlink guard to handle DOS-attribute prefixes.
Replace legacy p7zip installations with current mainline 7-Zip on hosts that run BBOT scans.
Run BBOT under a low-privilege service account restricted to a dedicated working directory outside of sensitive paths.

Patch Information

The fix is published in the BlackLanternSecurity BBOT repository. The patch to bbot/modules/internal/unarchive.py splits the Link = and Attributes = checks and inspects both the raw attribute value and the trailing unix mode field for l or h type flags. Review the BBOT security patch commit for the full diff.

Workarounds

Disable the filedownload module or the unarchive internal module until the patched BBOT version is deployed.
Restrict outbound network access from scan hosts so BBOT cannot retrieve untrusted archives.
Execute BBOT inside an ephemeral container whose filesystem is discarded after each scan, limiting the persistence of any planted symlink.

bash

# Update BBOT to the patched release
pip install --upgrade bbot

# Verify the p7zip build in use
7z --help | head -n 2

# Confirm the unarchive guard rejects DOS-prefixed symlink listings
python -c "import bbot, inspect, bbot.modules.internal.unarchive as u; print(inspect.getsourcefile(u))"