CVE-2026-14967
Path traversal in github_workflows allows writing artifacts outside output directory
CVE-2026-14967 is a low vulnerability (CVSS 3.1) in Black Lantern Security Bbot, published July 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in bbot 3.0.0.
BBOT's github_workflows module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve .., so a crafted CODE_REPOSITORY URL could traverse out of the intended folder. The write is bounded to two directory levels above the output location and its target is determined by the operator's configuration, not the attacker.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Path traversal in github_workflows allows writing artifacts outside output directory
BBOT's github_workflows module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve .., so a crafted CODE_REPOSITORY URL could traverse out of the intended folder. The write is bounded to two directory levels above the output location and its target is determined by the operator's configuration, not the attacker.
- Record
CVE-2026-14967- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2026-42296
BBOT's github_workflows module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve .., so a crafted CODE_REPOSITORY URL could traverse out of the intended folder. The write is bounded to two directory levels above the output location and its target is determined by the operator's configuration, not the attacker.
- Record
EUVD-2026-42296- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
NVD
BBOT's github_workflows module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve .., so a crafted CODE_REPOSITORY URL could traverse out of the intended folder. The write is bounded to two directory levels above the output location and its target is determined by the operator's configuration, not the attacker.
- Record
CVE-2026-14967- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
BBOT's github_workflows module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve .., so a crafted CODE_REPOSITORY URL could traverse out of the intended folder. The write is bounded to two directory levels above the output location and its target is determined by the operator's configuration, not the attacker.
- Record
CVE-2026-14967- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVPYSEC-2026-3720
BBOT's github_workflows module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve .., so a crafted CODE_REPOSITORY URL could traverse out of the intended folder. The write is bounded to two directory levels above the output location and its target is determined by the operator's configuration, not the attacker.
- Record
PYSEC-2026-3720- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bbotPyPI |
1.1.7 up to 3.0.0, plus listed versions 1.1.7.2968rc01.1.7.2972rc01.1.7.2980rc01.1.7.2982rc01.1.7.2984rc0 Show 45 moreShow less1.1.7.2998rc01.1.7.2rc01.1.7.3001rc01.1.7.3005rc01.1.7.3010rc01.1.7.3012rc01.1.7.3020rc01.1.7.3022rc01.1.7.3024rc01.1.7.3028rc01.1.7.3042rc01.1.7.3044rc01.1.7.3050rc01.1.7.3052rc01.1.7.3054rc01.1.7.3061rc01.1.7.3072rc01.1.7.3078rc01.1.7.3083rc01.1.7.3085rc01.1.7.3087rc01.1.7.3089rc01.1.7.3091rc01.1.7.3093rc01.1.7.3095rc01.1.7.3098rc01.1.7.3108rc01.1.7.3131rc01.1.7.3133rc01.1.7.3144rc01.1.7.3146rc01.1.7.3148rc01.1.7.3150rc01.1.7.3152rc01.1.7.3172rc01.1.7.3175rc01.1.7.3177rc01.1.7.3179rc01.1.7.3196rc01.1.7.3207rc01.1.7.3209rc01.1.7.3211rc01.1.7.3213rc01.1.7.3218rc01.1.7.3220rc0 |
3.0.0 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, NVD, OSV |
References
Left out here: 449 versions. The JSON record has them.