CVE-2026-14967: BBOT Path Traversal Vulnerability

CVE-2026-14967 Overview

CVE-2026-14967 is a path traversal vulnerability in BBOT's github_workflows module. The module downloads GitHub Actions workflow artifacts and writes them to an operator-configured output directory. Its path-containment check failed to resolve .. sequences, allowing a crafted CODE_REPOSITORY URL to escape the intended folder. The write is bounded to two directory levels above the configured output location. The target path is determined by the operator's configuration rather than the attacker, which limits practical impact. This weakness is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
A crafted GitHub repository URL supplied as a BBOT scan target can cause artifacts to be written outside the configured output directory, corrupting adjacent files with limited attacker control over the destination.

Affected Products

BBOT (Bighuge BLS OSINT Tool) by Black Lantern Security
BBOT github_workflows module
BBOT deployments processing untrusted CODE_REPOSITORY events

Discovery Timeline

2026-07-08 - CVE-2026-14967 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-14967

Vulnerability Analysis

BBOT is an open source recon framework that enumerates attack surfaces across web, DNS, and code assets. The github_workflows module consumes CODE_REPOSITORY events, retrieves GitHub Actions workflow runs, and stores downloaded artifacts on disk. The module includes a check intended to keep writes inside its configured output directory. The check compared string prefixes without first canonicalizing the path. Attackers can therefore embed .. segments in a repository URL to traverse upward before the containment check runs.

The patch tightens event filtering so that only events whose host is exactly github.com are processed. This prevents attacker-controlled hostnames from being coerced into the download path and reduces the traversal surface. The write remains bounded to two directory levels above the output location, and the final path is influenced by operator configuration.

Root Cause

The root cause is missing path canonicalization before validation. The original code accepted any URL containing the substring github.com, which allowed hostnames like evil.github.com.attacker.tld and traversal-laden paths to bypass intended constraints.

Attack Vector

Exploitation requires an operator to run BBOT against an attacker-supplied or attacker-influenced CODE_REPOSITORY target. User interaction is required, attack complexity is high, and no privileges are needed on the target host.

python

     async def filter_event(self, event):
         if "git" not in event.tags:
             return False, "event is not a git repository"
-        elif "github.com" not in event.url:
+        elif str(event.host) != "github.com":
             return False, "event is not a github repository"
         return True

Source: BBOT commit c1c6ec0

The patch replaces the loose substring match on event.url with a strict equality check on event.host, eliminating hostname spoofing paths into the download routine.

Detection Methods for CVE-2026-14967

Indicators of Compromise

Files written by BBOT outside the configured output_dir, particularly one or two directory levels above it.
CODE_REPOSITORY events in BBOT logs whose URL host is not exactly github.com or which contain .. segments.
Unexpected modifications to configuration or scan-adjacent files on hosts running BBOT scans.

Detection Strategies

Audit BBOT scan logs for github_workflows module activity involving non-canonical GitHub hostnames.
Compare BBOT output directory contents against expected artifact layouts to identify stray writes.
Review file integrity monitoring alerts on directories that sit one or two levels above BBOT output paths.

Monitoring Recommendations

Enable filesystem auditing on the parent directories of any BBOT output_dir.
Alert on writes performed by the BBOT process user outside the declared output tree.
Track BBOT version strings in inventory to identify hosts running vulnerable releases.

How to Mitigate CVE-2026-14967

Immediate Actions Required

Upgrade BBOT to a release that includes commit c1c6ec05ff998e2fba55a14d1026f12563ccd82f or later.
Restrict BBOT scan targets to trusted CODE_REPOSITORY sources until the upgrade is applied.
Run BBOT under a low-privilege service account with write access limited to its output directory.

Patch Information

The fix is available in the BBOT repository via the github_workflows path traversal patch. It enforces strict host equality (str(event.host) == "github.com") before the module accepts a repository event, preventing crafted URLs from reaching the download path.

Workarounds

Disable the github_workflows module in BBOT configuration until patching is complete.
Sandbox BBOT execution inside a container or chroot with the output directory as the only writable mount.
Validate any operator-supplied CODE_REPOSITORY targets to ensure the host resolves exactly to github.com.

bash

# Disable the vulnerable module in BBOT configuration
bbot -t targets.txt -em github_workflows

# Or exclude via config file (bbot.yml)
modules:
  github_workflows:
    enabled: false