CVE-2026-14967 Path traversal in github_workflows allows writing artifacts outside output directory
Attackers can write files outside the intended directory via crafted URLs in BBOT's github_workflows module, potentially modifying files in adjacent directories.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-14967?
CVE-2026-14967 is a low-severity path traversal vulnerability in Black Lantern Security BBOT, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve `..`, so a crafted `CODE_REPOSITORY` URL could traverse out of the intended folder. The write is bounded to two directory levels above the output location and its target is determined by the operator's configuration, not the attacker.
Weakness: CWE-22
Which versions are affected by CVE-2026-14967?
1 open source package ship an affected version, including bbot. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
bbot PyPI | From 1.1.7 | 3.0.0 |
Products include Blacklanternsecurity Bbot.
How do I fix CVE-2026-14967?
Upgrade bbot to 3.0.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-14967 being exploited?
There is no known exploitation of CVE-2026-14967 in the wild and no public exploit code.
Other vulnerabilities in Black Lantern Security BBOT
Sources
Also known as PYSEC-2026-3720.