CVE-2026-14967: BBOT Path Traversal in GitHub Workflows Module—Low-Risk Artifact Write Bypass

Technical summary

CVE-2026-14967 is a path traversal flaw (CWE-22) in BBOT's `github_workflows` reconnaissance module. The vulnerability exists in the module's artifact download functionality, which performs path-containment validation without properly resolving relative path components. An attacker can craft a malicious `CODE_REPOSITORY` URL containing `..` sequences to bypass the containment check. The resulting write operation would place a downloaded artifact up to two directory levels above the module's configured output directory. Since BBOT is a reconnaissance and enumeration tool, this module is typically used during security assessments to gather intelligence from GitHub workflows and related artifacts.

Business impact

The business risk is limited by the vulnerability's constraints. An attacker cannot write to arbitrary filesystem locations—only to a bounded scope two levels above the output directory. Moreover, the final target path is influenced by the operator's own configuration, not attacker input. Organizations running BBOT during reconnaissance phases face a low but non-zero risk of unauthorized file writes to nearby directories. This could lead to overwriting non-sensitive configuration files, logs, or temporary data in adjacent folders, but is unlikely to compromise core system integrity or sensitive data stores. The impact is primarily relevant in shared or multi-user environments where the operator and attacker threat models overlap.

Affected systems

BBOT and specifically its `github_workflows` module are affected. The vulnerability manifests when this module is invoked to download and process GitHub workflow artifacts. The issue is tied to the path-handling logic in that module's artifact download routine. No specific version ranges, vendor products, or patch versions are enumerated in the available source data; organizations using BBOT should verify their installed version against the official BBOT repository and advisory to confirm applicability.

Exploitability

Exploitation requires user interaction and specific conditions. An attacker must convince or trick a BBOT operator into running a scan using a crafted `CODE_REPOSITORY` URL. The CVSS vector (AV:N/AC:H/PR:N/UI:R) reflects this: network-accessible, high attack complexity, no authentication required, but user interaction is mandatory. The attacker has no direct control over the final write location—that depends on the operator's output directory configuration—making reliable, targeted exploitation difficult. An attacker would need to know or infer the operator's directory structure to predict where artifacts would land, raising the bar further.

Remediation

Apply the latest BBOT patch that addresses path traversal in the `github_workflows` module. The fix should implement proper canonicalization of file paths, resolving all `..` and `.` components before validating containment. Operators should verify that path-checking logic resolves symbolic links and relative sequences to their absolute forms before comparison against allowed directories. Post-patch, validate that the module correctly rejects or sanitizes any URLs or file paths containing directory traversal sequences.

Patch guidance

Check the official BBOT repository (https://github.com/blacklanternsecurity/bbot) for security advisories and updates. Verify the publication date (CVE-2026-14967 was published 2026-07-08) and identify the corresponding patch release. Update BBOT to a version released on or after the advisory date. Test the patched version in a non-production environment to confirm the `github_workflows` module functions as expected without artifact write errors. Maintain regular dependency and security advisory monitoring to catch future issues promptly.

Detection guidance

Monitor BBOT execution logs for any write operations outside the configured output directory, particularly writes to parent directories. File integrity monitoring (FIM) tools can alert on unexpected modifications to directories immediately above the intended output folder. Look for unusual file creation or overwrite events in adjacent directories during or immediately after BBOT reconnaissance scans. If possible, restrict BBOT's filesystem permissions to limit write access only to its designated output directory and, if necessary, one level up. Review access logs and audit trails for any suspicious `CODE_REPOSITORY` URLs or scan configurations that included `..` sequences.

Why prioritize this

Although the CVSS score is LOW (3.1), this vulnerability warrants attention because it affects a reconnaissance tool commonly used in security assessments and red-team operations. Path traversal flaws are foundational attack vectors; even bounded ones can be chained with other misconfigurations or social engineering. In multi-user or shared lab environments, accidental or intentional artifact writes to sibling directories could corrupt workflows or configurations. The requirement for user interaction and the bounded scope reduce urgency, but patching is still sensible as part of routine tool maintenance.

Risk score, explained

The CVSS 3.1 score of 3.1 (LOW) reflects the controlled nature of this vulnerability. Attack vector is network (the attacker can supply a URL), but attack complexity is high due to the user interaction requirement. There is no confidentiality or availability impact—only integrity of nearby, non-critical directories is at risk. The vulnerability does not grant remote code execution, privilege escalation, or access to sensitive data. The bounded write scope (two directory levels maximum) and operator-controlled output directory location further limit the realistic impact, keeping the score in the LOW range.

Frequently asked questions