CVE-2026-14966

BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produced by legacy versions of p7zip. Such an archive, downloaded and extracted during a scan (for example via filedownload), bypassed the guard and caused an attacker-controlled symlink to be written into the extraction directory. The effect is limited to planting the symlink (its target is not written through), and only hosts using such a legacy p7zip build are affected; current mainline 7-Zip is not.

• blacklanternsecurity bbot (>= 2.3.1 <= 2.8.6) • blacklanternsecurity bbot 3.0.0.0 • blacklanternsecurity bbot 3.0.0.647 • blacklanternsecurity bbot 3.0.0.649 • blacklanternsecurity bbot 3.0.0.652 • blacklanternsecurity bbot 3.0.0.654 • blacklanternsecurity bbot 3.0.0.659 • blacklanternsecurity bbot 3.0.0.669 • blacklanternsecurity bbot 3.0.0.671 • blacklanternsecurity bbot 3.0.0.673 • blacklanternsecurity bbot 3.0.0.691 • blacklanternsecurity bbot 3.0.0.765 • blacklanternsecurity bbot 3.0.0.767 • blacklanternsecurity bbot 3.0.0.773 • blacklanternsecurity bbot 3.0.0.782 • blacklanternsecurity bbot 3.0.0.786 • blacklanternsecurity bbot 3.0.0.793 • blacklanternsecurity bbot 3.0.0.795 • blacklanternsecurity bbot 3.0.0.798 • blacklanternsecurity bbot 3.0.0.819 • blacklanternsecurity bbot 3.0.0.821 • blacklanternsecurity bbot 3.0.0.829 • blacklanternsecurity bbot 3.0.0.836 • blacklanternsecurity bbot 3.0.0.849 • blacklanternsecurity bbot 3.0.0.851 • blacklanternsecurity bbot 3.0.0.858 • blacklanternsecurity bbot 3.0.0.870 • blacklanternsecurity bbot 3.0.0.876 • blacklanternsecurity bbot 3.0.0.884 • blacklanternsecurity bbot 3.0.0.897 • blacklanternsecurity bbot 3.0.0.903 • blacklanternsecurity bbot 3.0.0.907 • blacklanternsecurity bbot 3.0.0.909 • blacklanternsecurity bbot 3.0.0.981 • blacklanternsecurity bbot 3.0.0.986 • blacklanternsecurity bbot 3.0.0.1056 • blacklanternsecurity bbot 3.0.0.1062 • blacklanternsecurity bbot 3.0.0.1064 • blacklanternsecurity bbot 3.0.0.1068 • blacklanternsecurity bbot 3.0.0.1070 • blacklanternsecurity bbot 3.0.0.1079 • blacklanternsecurity bbot 3.0.0.1137 • blacklanternsecurity bbot 3.0.0.1139 • blacklanternsecurity bbot 3.0.0.1141 • blacklanternsecurity bbot 3.0.0.1153 • blacklanternsecurity bbot 3.0.0.1173 • blacklanternsecurity bbot 3.0.0.1184 • blacklanternsecurity bbot 3.0.0.1190 • blacklanternsecurity bbot 3.0.0.1254 • blacklanternsecurity bbot 3.0.0.1271 • blacklanternsecurity bbot 3.0.0.1274 • blacklanternsecurity bbot 3.0.0.1304 • blacklanternsecurity bbot 3.0.0.1313 • blacklanternsecurity bbot 3.0.0.1317 • blacklanternsecurity bbot 3.0.0.1333 • blacklanternsecurity bbot 3.0.0.1343 • blacklanternsecurity bbot 3.0.0.1345 • blacklanternsecurity bbot 3.0.0.1349 • blacklanternsecurity bbot 3.0.0.1386 • blacklanternsecurity bbot 3.0.0.1388 … and 3 more