CVE-2026-14967

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-14967
BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve `..`, so a crafted `CODE_REPOSITORY` URL could traverse out of the intended folder. The write is bounded to two directory levels above the output location and its target is determined by the operator's configuration, not the attacker.

3.1 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/blacklanternsecurity/bbot/commit/c1c6ec05ff998e2fba55a14d1026f12563ccd82f Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:blacklanternsecurity:bbot:*:*:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.0:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.647:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.649:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.652:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.654:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.659:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.669:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.671:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.673:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.691:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.765:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.767:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.773:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.782:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.786:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.793:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.795:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.798:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.819:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.821:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.829:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.836:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.849:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.851:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.858:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.870:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.876:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.884:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.897:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.903:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.907:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.909:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.981:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.986:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1056:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1062:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1064:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1068:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1070:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1079:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1137:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1139:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1141:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1153:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1173:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1184:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1190:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1254:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1271:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1274:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1304:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1313:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1317:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1333:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1343:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1345:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1349:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1386:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1388:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1390:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1401:rc:*:*:*:*:*:*
cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1407:rc:*:*:*:*:*:*
History

No history.

Information

Published : 2026-07-08 16:16

Updated : 2026-08-19 17:27

NVD link : CVE-2026-14967

Mitre link : CVE-2026-14967

CVE.ORG link : CVE-2026-14967

JSON object : View

Products Affected

blacklanternsecurity

  • bbot
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')