CVE-2026-55567

Name of the Vulnerable Software and Affected Versions BleachBit versions prior to 6.0.1

Description Privileged cleaning on Windows fails to lock and validate the parent directory of a target before deletion. A local unprivileged user can replace this directory with a Windows junction and utilize a native symlink to redirect the elevated deletion process toward an arbitrary file selected by the attacker. This arbitrary privileged file deletion can be leveraged alongside Windows Installer behavior to achieve local SYSTEM privileges.

Recommendations Update to version 6.0.1.