CVE-2026-14966

Name of the Vulnerable Software and Affected Versions BBOT (affected versions not specified)

Description The unarchive module fails to detect symlinks in zip and 7z archives when the listing includes a DOS-attribute prefix before the unix mode, a characteristic of legacy p7zip versions. This allows an attacker to bypass security guards during a scan, such as through the filedownload process, resulting in an attacker-controlled symlink being written into the extraction directory. The impact is limited to the creation of the symlink, as the target is not written through.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.