CVE-2026-14966: BBOT Symlink Validation Bypass in Archive Extraction

Technical summary

The vulnerability is a signature detection bypass in BBOT's unarchive module related to CWE-59 (Improper Link Resolution Before File Access). The module maintains a guard against extracting archives with symlink entries, but this guard uses pattern matching that does not account for symlink entries prefixed with DOS attributes in zip and 7z archive listings. When p7zip legacy versions list archive contents, they may prepend DOS attributes before the standard Unix mode string. An attacker-controlled archive exploiting this discrepancy can cause the extraction process to overlook the symlink check, resulting in a symlink being materialized on disk in the target extraction directory. The attacker's ability is confined to symlink creation; the symlink target itself is not written or followed, and exploitation requires user interaction or automated scanning that processes untrusted archives.

Business impact

The business impact is contained. An attacker could plant a symlink in a location where BBOT performs extraction, potentially setting up for a follow-on attack that leverages the symlink for directory traversal or privilege escalation in subsequent operations. However, the immediate risk is limited because the symlink target is not accessed during extraction. Organizations running BBOT scans on untrusted content—particularly those using legacy p7zip builds on their scanning infrastructure—should be aware that malicious archives may persist symlinks that could be exploited in multi-stage attacks or if the symlink target is later accessed by other processes. For most organizations using current 7-Zip versions, the risk is minimal.

Affected systems

BBOT (the open-source reconnaissance and vulnerability scanning framework) is affected. The vulnerability is specific to systems that: (1) run BBOT with the unarchive module enabled, (2) process zip or 7z archives during scans, and (3) have legacy p7zip installed as the archive extraction backend. Current mainline 7-Zip is not affected. The vulnerability is most relevant for organizations running BBOT in CI/CD pipelines, security research environments, or automated scanning workflows where untrusted or user-supplied archives may be processed. It does not affect other archive utilities or scanning tools unless they similarly use legacy p7zip without proper symlink validation.

Exploitability

Exploitability is low due to multiple constraints. The CVSS score of 3.1 reflects this: the attack vector is network-based, but it requires high complexity (crafting a specially-formatted archive with DOS-attribute-prefixed symlinks) and user interaction (the archive must be downloaded and scanned). The attacker has no control over where the symlink is created beyond the extraction directory, and the symlink target is not dereferenced. Exploitation requires that a target system use legacy p7zip rather than current 7-Zip, further limiting the real-world attack surface. An attacker would need to combine this symlink planting with knowledge of the extraction path and a subsequent action that follows the symlink in order to achieve a meaningful security breach.

Remediation

The primary remediation is to upgrade BBOT to a patched version that properly validates symlinks in archives regardless of DOS-attribute formatting. Verify against the official BBOT repository or vendor advisory for the specific version that addresses this vulnerability. As an interim measure, if patching is delayed, restrict BBOT scans to trusted archive sources, disable the unarchive module if not needed, or upgrade the underlying archive extraction tool to current mainline 7-Zip, which does not exhibit this signature-bypass behavior. Environment isolation—ensuring BBOT runs with minimal privileges and in a sandboxed or containerized context—further reduces the risk of symlink-based escalation.

Patch guidance

Consult the BBOT project's official advisories and release notes for the exact patched version. Apply the patch as soon as it becomes available in your deployment channel (pip, container image, or source repository). If BBOT is integrated into CI/CD or automated scanning workflows, plan patching to avoid disruption, but prioritize it given the ease with which archives can be supplied by external or less-trusted sources. Test the patched version in a non-production environment to ensure compatibility with your scanning configuration before rolling out to production.

Detection guidance

Monitor for BBOT extraction activity on archives from untrusted sources. Check for symlink creation in directories where BBOT extracts archives; a spike in symlink creation during or after archive extraction may indicate exploitation. Review BBOT logs for warnings or errors related to archive processing. Implement file integrity monitoring on extraction directories to detect unexpected symlink presence. Network-level detection is difficult without archive inspection, so focus on host-based signals: monitor file system events for symlink creation in BBOT working directories, and correlate these with archive extraction operations. If you maintain legacy p7zip builds, consider audit logging around their use.

Why prioritize this

While the CVSS score is low (3.1), this vulnerability should be addressed with moderate priority because it directly undermines a security control (the symlink filter in the unarchive module) and requires only network delivery of a malicious archive plus user interaction—both common in scanning workflows. It is not a critical emergency, but it should not be deferred indefinitely, especially in environments that process untrusted content. The narrow scope (legacy p7zip only, DOS-attribute prefix only) means that risk assessment can be tailored to your actual infrastructure; if you confirmed you use only current 7-Zip, the priority drops.

Risk score, explained

The CVSS v3.1 score of 3.1 (LOW) reflects: Attack Vector = Network (attacker can deliver the malicious archive over the network), Attack Complexity = High (the attacker must craft an archive with a specific format that includes DOS attributes before Unix mode strings, and legacy p7zip must be in use), Privileges Required = None, User Interaction = Required (a scan must be triggered on the archive), Scope = Unchanged, Confidentiality Impact = None, Integrity Impact = Low (a symlink is planted, allowing potential follow-on attacks but not immediate data compromise), Availability Impact = None. The score appropriately reflects that this is a limited, conditional vulnerability requiring multiple constraints to be exploited, with impact confined to symlink creation.

Frequently asked questions