CVE-2026-14966 Blacklanternsecurity CVE debrief

Who should care

Security teams and administrators managing Blacklanternsecurity's Bbot installations, especially those using versions between 2.3.1 and 2.8.6, or various 3.0.0 rc versions, should be aware of this vulnerability and take steps to patch or mitigate it.

Technical summary

The Bbot unarchive module incorrectly handles zip and 7z archives containing symlink entries produced by legacy p7zip versions. An attacker could exploit this by downloading and extracting a malicious archive, resulting in an attacker-controlled symlink being written to the extraction directory. The vulnerability's impact is limited to planting the symlink, as its target is not written through. Current mainline 7-Zip is not affected.

Defensive priority

Organizations using Blacklanternsecurity's Bbot, particularly versions between 2.3.1 and 2.8.6, and various 3.0.0 rc versions, should prioritize patching to prevent potential symlink attacks.

Recommended defensive actions

• Inventory and update Bbot installations to ensure version 2.8.7 or later is used, or apply the patch from commit a3f1a2292e2b0a553827c6175b761abe28807735.
• Implement compensating controls such as monitoring for unusual symlink creation in Bbot extraction directories.
• Verify that Bbot configurations restrict extraction of untrusted archives.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE-2026-14966 issue involves BBOT's unarchive module incorrectly handling zip and 7z archives with symlink entries produced by legacy p7zip versions. This could allow an attacker to plant a symlink in the extraction directory. The attack requires user interaction and has limited impact, with a CVSS score of 3.1. A patch is available in commit a3f1a2292e2b0a553827c6175b761abe28807735.

Official resources