{"id":"CVE-2026-14966","aliases":["PYSEC-2026-3719"],"title":"BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect sy…","summary":"BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produced by legacy vers…","severity":"low","cvss":3.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","vendor":"bbot","product":"bbot","ecosystem":"pip","affected":["bbot >= 2.3.1, < 3.0.0"],"patched":["bbot 3.0.0"],"published":"2026-07-08","updated":"2026-08-20","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/PYSEC-2026-3719","references":[{"url":"https://github.com/blacklanternsecurity/bbot/commit/a3f1a2292e2b0a553827c6175b761abe28807735"}],"tags":["osv","pip"],"epss":0.00384,"epssPercentile":0.32295,"ingestedAt":"2026-08-20T19:23:08.392Z","slug":"CVE-2026-14966","body":"## Overview\n\nBBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produced by legacy versions of p7zip. Such an archive, downloaded and extracted during a scan (for example via filedownload), bypassed the guard and caused an attacker-controlled symlink to be written into the extraction directory. The effect is limited to planting the symlink (its target is not written through), and only hosts using such a legacy p7zip build are affected; current mainline 7-Zip is not.\n\n## Affected packages\n\n- `bbot >= 2.3.1, < 3.0.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `bbot 3.0.0`","depth":"sunlit","depthScore":17,"depthScoreParts":{"impact":17.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}