EUVD-2026-42295Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Network vector because attacker serves the archive remotely; AC:H due to hard legacy-p7zip prerequisite; UI:R for required user-initiated scan; I:L only as symlink is planted but not resolved.
Primary rating from Vendor (BLSOPS).
CVSS VectorVendor: BLSOPS
Lifecycle Timeline
1DescriptionCVE.org
BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produced by legacy versions of p7zip. Such an archive, downloaded and extracted during a scan (for example via filedownload), bypassed the guard and caused an attacker-controlled symlink to be written into the extraction directory. The effect is limited to planting the symlink (its target is not written through), and only hosts using such a legacy p7zip build are affected; current mainline 7-Zip is not.
AnalysisAI
Symlink extraction bypass in BBOT's unarchive module allows an attacker to plant an attacker-controlled symlink into the extraction directory when BBOT scans and fetches a crafted zip or 7z archive. The bypass exploits BBOT's failure to detect symlink entries carrying a DOS-attribute prefix before the unix mode field, a format produced by legacy p7zip builds - a variant the pre-extraction guard did not account for. Impact is strictly limited to symlink planting (the symlink target is not written through), and exploitation requires the scanning host to be running a legacy p7zip build; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Technical ContextAI
BBOT (Black Lantern Security's Bug Bounty Offensive Tool) is an automated security scanning framework. Its unarchive module is designed to inspect archive contents and reject entries containing symlinks before extraction - a safeguard against symlink traversal attacks (CWE-59: Improper Link Resolution Before File Access). The bypass targets zip and 7z archive formats specifically: when a symlink entry's metadata carries a DOS-attribute field as a prefix before the unix file-mode bits - a format quirk of legacy p7zip versions - BBOT's symlink detection logic failed to recognize the entry as a symlink and proceeded with extraction. This allowed an attacker to craft such an archive and have BBOT write a symlink they control into the local extraction directory. The affected CPE is cpe:2.3:a:black_lantern_security:bbot:*:*:*:*:*:*:*:*, indicating all tracked versions prior to the fix. Current mainline 7-Zip does not produce the triggering format, so the attack surface is constrained to environments with the legacy p7zip toolchain installed.
RemediationAI
Apply the upstream fix by updating BBOT to a version incorporating commit a3f1a2292e2b0a553827c6175b761abe28807735 (https://github.com/blacklanternsecurity/bbot/commit/a3f1a2292e2b0a553827c6175b761abe28807735). A specific tagged release containing this patch has not been independently confirmed from the available data, so operators should verify the commit is present in their installed version. As a compensating control, replace or upgrade any legacy p7zip installations to current mainline 7-Zip, which does not produce the DOS-attribute-prefixed symlink format that triggers the bypass - this eliminates the vulnerability's precondition even before a BBOT patch is applied. Alternatively, disable the filedownload and unarchive modules in BBOT scan configurations if archive extraction from untrusted sources is not operationally required; this prevents the scan from fetching and extracting attacker-controlled content entirely, though it reduces scan coverage.
Arbitrary file write in BBOT's postman_download module enables a remote attacker to write files outside the intended out
Path traversal in BBOT's unarchive internal module enables a malicious archive hosted by attacker-controlled infrastruct
Authentication token leakage in Black Lantern Security's bbot docker_pull module exposes Docker credentials to MITM atta
Symlink-following path traversal in BBOT's github_workflows module (all versions prior to commit 16d9c42b6) allows a loc
Path traversal in BBOT's github_workflows module allows a crafted CODE_REPOSITORY URL to write a downloaded artifact out
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today