OR
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.0:rc:*:*:*:*:*:*
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1056:rc:*:*:*:*:*:*
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1062:rc:*:*:*:*:*:*
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1064:rc:*:*:*:*:*:*
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1068:rc:*:*:*:*:*:*
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1070:rc:*:*:*:*:*:*
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1079:rc:*:*:*:*:*:*
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1137:rc:*:*:*:*:*:*
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1139:rc:*:*:*:*:*:*
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1141:rc:*:*:*:*:*:*
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1153:rc:*:*:*:*:*:*
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1173:rc:*:*:*:*:*:*
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1184:rc:*:*:*:*:*:*
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1190:rc:*:*:*:*:*:*
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1254:rc:*:*:*:*:*:*
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1271:rc:*:*:*:*:*:*
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1274:rc:*:*:*:*:*:*
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1304:rc:*:*:*:*:*:*
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1313:rc:*:*:*:*:*:*
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1317:rc:*:*:*:*:*:*
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1333:rc:*:*:*:*:*:*
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1343:rc:*:*:*:*:*:*
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1345:rc:*:*:*:*:*:*
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1349:rc:*:*:*:*:*:*
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1386:rc:*:*:*:*:*:*
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1388:rc:*:*:*:*:*:*
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1390:rc:*:*:*:*:*:*
          *cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1401:rc:*:*:*:*:*:*
    

Black Lantern Security: https://github.com/blacklanternsecurity/bbot/commit/a3f1a2292e2b0a553827c6175b761abe28807735 Types: Patch

{"timestamp":"2026-07-08T15:57:06.003777Z","id":"CVE-2026-14966","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produced by legacy versions of p7zip. Such an archive, downloaded and extracted during a scan (for example via filedownload), bypassed the guard and caused an attacker-controlled symlink to be written into the extraction directory. The effect is limited to planting the symlink (its target is not written through), and only hosts using such a legacy p7zip build are affected; current mainline 7-Zip is not.

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

CWE-59

https://github.com/blacklanternsecurity/bbot/commit/a3f1a2292e2b0a553827c6175b761abe28807735

[{"vendor":"Black Lantern Security","product":"BBOT","defaultStatus":"unaffected","repo":"https://github.com/blacklanternsecurity/bbot","versions":[{"version":"2.3.1","lessThanOrEqual":"2.8.6","versionType":"custom","status":"affected"}]}]