CVE-2026-14967

3.1 Faible

Publiée le 08/07/2026 à 18:16 · Modifiée le 19/08/2026 à 19:27 · Analysée par le NVD · Source : cves@blacklanternsecurity.com

Description

BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve `..`, so a crafted `CODE_REPOSITORY` URL could traverse out of the intended folder. The write is bounded to two directory levels above the output location and its target is determined by the operator's configuration, not the attacker.

Traduire en français

Produits concernés

Black Lantern Security BBOT
Blacklanternsecurity bbot

Scores CVSS

Version	Score	Source	Vecteur
3.1	3.1 Faible	cves@blacklanternsecurity.com	`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-22

Références

https://github.com/blacklanternsecurity/bbot/commit/c1c6ec05ff998e2fba55a14d1026f12563ccd82f Patch

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories