CVE-2026-14967
Path traversal in github_workflows allows writing artifacts outside output directory
CVSS Score
3.1
EPSS Score
0.0%
EPSS Percentile
0th
BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve `..`, so a crafted `CODE_REPOSITORY` URL could traverse out of the intended folder. The write is bounded to two directory levels above the output location and its target is determined by the operator's configuration, not the attacker.
| CWE | CWE-22 |
| Vendor | black lantern security |
| Product | bbot |
| Published | Jul 8, 2026 |
| Last Updated | Jul 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for black lantern security bbot
Be the first to know when new low vulnerabilities affecting black lantern security bbot are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
Black Lantern Security / BBOT
1.1.7 ≤ 2.8.6