PT-2026-56472 · Black Lantern Security · Bbot

Publicado 2026-07-08 · Atualizado 2026-07-08 · CVE-2026-14967

Mitre

CVSS v3.1

3.1

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

BBOT's github workflows module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve .., so a crafted CODE REPOSITORY URL could traverse out of the intended folder. The write is bounded to two directory levels above the output location and its target is determined by the operator's configuration, not the attacker.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-14967

Produtos afetados

Bbot

Referências · 2

• https://github.com/blacklanternsecurity/bbot/commit/c1c6ec05ff998e2fba55a14d1026f12563ccd82f · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-14967 · Nota de Segurança