Vulnerability · Published Jul 8, 2026 · Assigned by BLSOPS
CVE-2026-14967Path traversal in github_workflows allows writing artifacts outside output directory
Low 3.1
In plain English
A low-severity path traversal in BBOT from Black Lantern Security. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve `..`, so a crafted `CODE_REPOSITORY` URL could traverse out of the intended folder. The write is bounded to two directory levels above the output location and its target is determined by the operator's configuration, not the attacker.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | bbot | 3.0.0 | PYSEC-2026-3720 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Black Lantern Security | BBOT | 1.1.7 – through 2.8.6 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N