CVE-2026-14967

Name of the Vulnerable Software and Affected Versions BBOT (affected versions not specified)

Description The github workflows module allows writing a downloaded artifact outside the configured output directory because the path-containment check fails to resolve .. sequences. This allows a crafted CODE REPOSITORY URL to perform a directory traversal. The write operation is limited to two directory levels above the output location, and the final target is determined by the operator's configuration rather than the attacker.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.