{"id":"CVE-2026-14966","aliases":["PYSEC-2026-3719","GHSA-xpf3-p7gm-7756"],"title":"BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect sy…","summary":"BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produced by legacy vers…","severity":"low","cvss":3.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","vendor":"bbot","product":"bbot","ecosystem":"pip","affected":["bbot >= 2.3.1, < 3.0.0"],"patched":["bbot 3.0.0"],"published":"2026-07-08","updated":"2026-10-15","sourceUpdated":"2026-10-15T14:45:06.605119963Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/PYSEC-2026-3719","references":[{"url":"https://github.com/blacklanternsecurity/bbot/commit/a3f1a2292e2b0a553827c6175b761abe28807735"},{"url":"https://github.com/advisories/GHSA-xpf3-p7gm-7756"},{"url":"https://github.com/blacklanternsecurity/bbot/security/advisories/GHSA-xpf3-p7gm-7756"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14966"},{"url":"https://github.com/blacklanternsecurity/bbot/commit/3bc8d3a96f34f312853c9fcf8decee2a4e905f26"},{"url":"https://github.com/blacklanternsecurity/bbot"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/bbot/PYSEC-2026-3719.yaml"}],"tags":["osv","pip","ghsa"],"epss":0.00384,"epssPercentile":0.32251,"cwe":["CWE-22","CWE-59"],"ingestedAt":"2026-08-20T19:23:08.392Z","slug":"CVE-2026-14966","body":"## Overview\n\nBBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produced by legacy versions of p7zip. Such an archive, downloaded and extracted during a scan (for example via filedownload), bypassed the guard and caused an attacker-controlled symlink to be written into the extraction directory. The effect is limited to planting the symlink (its target is not written through), and only hosts using such a legacy p7zip build are affected; current mainline 7-Zip is not.\n\n## Affected packages\n\n- `bbot >= 2.3.1, < 3.0.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `bbot 3.0.0`","depth":"sunlit","depthScore":17,"depthScoreParts":{"impact":17.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}