{"id":"CVE-2026-14966","details":"BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produced by legacy versions of p7zip. Such an archive, downloaded and extracted during a scan (for example via filedownload), bypassed the guard and caused an attacker-controlled symlink to be written into the extraction directory. The effect is limited to planting the symlink (its target is not written through), and only hosts using such a legacy p7zip build are affected; current mainline 7-Zip is not.","aliases":["PYSEC-2026-3719"],"modified":"2026-08-21T03:46:24.626782427Z","published":"2026-07-08T16:16:27.237Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"2.3.1"},{"last_affected":"2.8.6"}],"source":"CPE_RANGE","vendor_product":"blacklanternsecurity:bbot","cpes":["cpe:2.3:a:blacklanternsecurity:bbot:*:*:*:*:*:*:*:*"]}]},"references":[{"type":"FIX","url":"https://github.com/blacklanternsecurity/bbot/commit/a3f1a2292e2b0a553827c6175b761abe28807735"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/blacklanternsecurity/bbot","events":[{"introduced":"233c86ca8d277fe87c86b6cdce2499745b973c70"},{"last_affected":"e3baa4a4aae8b5cdb4ca623eb1fc6f12fe919ab0"},{"fixed":"a3f1a2292e2b0a553827c6175b761abe28807735"}],"database_specific":{"extracted_events":[{"introduced":"3.0.0.0-rc"},{"last_affected":"3.0.0.0-rc"},{"introduced":"3.0.0.647-rc"},{"last_affected":"3.0.0.647-rc"},{"introduced":"3.0.0.649-rc"},{"last_affected":"3.0.0.649-rc"},{"introduced":"3.0.0.652-rc"},{"last_affected":"3.0.0.652-rc"},{"introduced":"3.0.0.654-rc"},{"last_affected":"3.0.0.654-rc"},{"introduced":"3.0.0.659-rc"},{"last_affected":"3.0.0.659-rc"},{"introduced":"3.0.0.669-rc"},{"last_affected":"3.0.0.669-rc"},{"introduced":"3.0.0.671-rc"},{"last_affected":"3.0.0.671-rc"},{"introduced":"3.0.0.673-rc"},{"last_affected":"3.0.0.673-rc"},{"introduced":"3.0.0.691-rc"},{"last_affected":"3.0.0.691-rc"},{"introduced":"3.0.0.765-rc"},{"last_affected":"3.0.0.765-rc"},{"introduced":"3.0.0.767-rc"},{"last_affected":"3.0.0.767-rc"},{"introduced":"3.0.0.773-rc"},{"last_affected":"3.0.0.773-rc"},{"introduced":"3.0.0.782-rc"},{"last_affected":"3.0.0.782-rc"},{"introduced":"3.0.0.786-rc"},{"last_affected":"3.0.0.786-rc"},{"introduced":"3.0.0.793-rc"},{"last_affected":"3.0.0.793-rc"},{"introduced":"3.0.0.795-rc"},{"last_affected":"3.0.0.795-rc"},{"introduced":"3.0.0.798-rc"},{"last_affected":"3.0.0.798-rc"},{"introduced":"3.0.0.819-rc"},{"last_affected":"3.0.0.819-rc"},{"introduced":"3.0.0.821-rc"},{"last_affected":"3.0.0.821-rc"},{"introduced":"3.0.0.829-rc"},{"last_affected":"3.0.0.829-rc"},{"introduced":"3.0.0.836-rc"},{"last_affected":"3.0.0.836-rc"},{"introduced":"3.0.0.849-rc"},{"last_affected":"3.0.0.849-rc"},{"introduced":"3.0.0.851-rc"},{"last_affected":"3.0.0.851-rc"},{"introduced":"3.0.0.858-rc"},{"last_affected":"3.0.0.858-rc"},{"introduced":"3.0.0.870-rc"},{"last_affected":"3.0.0.870-rc"},{"introduced":"3.0.0.876-rc"},{"last_affected":"3.0.0.876-rc"},{"introduced":"3.0.0.884-rc"},{"last_affected":"3.0.0.884-rc"},{"introduced":"3.0.0.897-rc"},{"last_affected":"3.0.0.897-rc"},{"introduced":"3.0.0.903-rc"},{"last_affected":"3.0.0.903-rc"},{"introduced":"3.0.0.907-rc"},{"last_affected":"3.0.0.907-rc"},{"introduced":"3.0.0.909-rc"},{"last_affected":"3.0.0.909-rc"},{"introduced":"3.0.0.981-rc"},{"last_affected":"3.0.0.981-rc"},{"introduced":"3.0.0.986-rc"},{"last_affected":"3.0.0.986-rc"},{"introduced":"3.0.0.1056-rc"},{"last_affected":"3.0.0.1056-rc"},{"introduced":"3.0.0.1062-rc"},{"last_affected":"3.0.0.1062-rc"},{"introduced":"3.0.0.1064-rc"},{"last_affected":"3.0.0.1064-rc"},{"introduced":"3.0.0.1068-rc"},{"last_affected":"3.0.0.1068-rc"},{"introduced":"3.0.0.1070-rc"},{"last_affected":"3.0.0.1070-rc"},{"introduced":"3.0.0.1079-rc"},{"last_affected":"3.0.0.1079-rc"},{"introduced":"3.0.0.1137-rc"},{"last_affected":"3.0.0.1137-rc"},{"introduced":"3.0.0.1139-rc"},{"last_affected":"3.0.0.1139-rc"},{"introduced":"3.0.0.1141-rc"},{"last_affected":"3.0.0.1141-rc"},{"introduced":"3.0.0.1153-rc"},{"last_affected":"3.0.0.1153-rc"},{"introduced":"3.0.0.1173-rc"},{"last_affected":"3.0.0.1173-rc"},{"introduced":"3.0.0.1184-rc"},{"last_affected":"3.0.0.1184-rc"},{"introduced":"3.0.0.1190-rc"},{"last_affected":"3.0.0.1190-rc"},{"introduced":"3.0.0.1254-rc"},{"last_affected":"3.0.0.1254-rc"},{"introduced":"3.0.0.1271-rc"},{"last_affected":"3.0.0.1271-rc"},{"introduced":"3.0.0.1274-rc"},{"last_affected":"3.0.0.1274-rc"},{"introduced":"3.0.0.1304-rc"},{"last_affected":"3.0.0.1304-rc"},{"introduced":"3.0.0.1313-rc"},{"last_affected":"3.0.0.1313-rc"},{"introduced":"3.0.0.1317-rc"},{"last_affected":"3.0.0.1317-rc"},{"introduced":"3.0.0.1333-rc"},{"last_affected":"3.0.0.1333-rc"},{"introduced":"3.0.0.1343-rc"},{"last_affected":"3.0.0.1343-rc"},{"introduced":"3.0.0.1345-rc"},{"last_affected":"3.0.0.1345-rc"},{"introduced":"3.0.0.1349-rc"},{"last_affected":"3.0.0.1349-rc"},{"introduced":"3.0.0.1386-rc"},{"last_affected":"3.0.0.1386-rc"},{"introduced":"3.0.0.1388-rc"},{"last_affected":"3.0.0.1388-rc"},{"introduced":"3.0.0.1390-rc"},{"last_affected":"3.0.0.1390-rc"},{"introduced":"3.0.0.1401-rc"},{"last_affected":"3.0.0.1401-rc"},{"introduced":"3.0.0.1407-rc"},{"last_affected":"3.0.0.1407-rc"}],"source":["CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.0:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.647:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.649:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.652:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.654:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.659:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.669:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.671:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.673:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.691:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.765:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.767:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.773:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.782:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.786:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.793:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.795:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.798:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.819:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.821:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.829:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.836:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.849:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.851:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.858:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.870:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.876:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.884:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.897:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.903:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.907:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.909:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.981:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.986:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1056:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1062:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1064:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1068:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1070:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1079:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1137:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1139:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1141:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1153:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1173:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1184:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1190:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1254:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1271:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1274:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1304:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1313:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1317:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1333:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1343:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1345:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1349:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1386:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1388:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1390:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1401:rc:*:*:*:*:*:*","cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1407:rc:*:*:*:*:*:*"]}}],"versions":["3.0.0.0-rc","3.0.0.1056-rc","3.0.0.1062-rc","3.0.0.1064-rc","3.0.0.1068-rc","3.0.0.1070-rc","3.0.0.1079-rc","3.0.0.1137-rc","3.0.0.1139-rc","3.0.0.1141-rc","3.0.0.1153-rc","3.0.0.1173-rc","3.0.0.1184-rc","3.0.0.1190-rc","3.0.0.1254-rc","3.0.0.1271-rc","3.0.0.1274-rc","3.0.0.1304-rc","3.0.0.1313-rc","3.0.0.1317-rc","3.0.0.1333-rc","3.0.0.1343-rc","3.0.0.1345-rc","3.0.0.1349-rc","3.0.0.1386-rc","3.0.0.1388-rc","3.0.0.1390-rc","3.0.0.1401-rc","3.0.0.1407-rc","3.0.0.647-rc","3.0.0.649-rc","3.0.0.652-rc","3.0.0.654-rc","3.0.0.659-rc","3.0.0.669-rc","3.0.0.671-rc","3.0.0.673-rc","3.0.0.691-rc","3.0.0.765-rc","3.0.0.767-rc","3.0.0.773-rc","3.0.0.782-rc","3.0.0.786-rc","3.0.0.793-rc","3.0.0.795-rc","3.0.0.798-rc","3.0.0.819-rc","3.0.0.821-rc","3.0.0.829-rc","3.0.0.836-rc","3.0.0.849-rc","3.0.0.851-rc","3.0.0.858-rc","3.0.0.870-rc","3.0.0.876-rc","3.0.0.884-rc","3.0.0.897-rc","3.0.0.903-rc","3.0.0.907-rc","3.0.0.909-rc","3.0.0.981-rc","3.0.0.986-rc","v3.0.0.1407rc","v3.0.0.1401rc","v3.0.0.1390rc","v3.0.0.1386rc","v3.0.0.1388rc","v3.0.0.1349rc","v3.0.0.1345rc","v3.0.0.1343rc","v3.0.0.1333rc","v3.0.0.1317rc","v3.0.0.1313rc","v3.0.0.1304rc","v3.0.0.1274rc","v3.0.0.1271rc","v3.0.0.1254rc","v3.0.0.1190rc","v3.0.0.1184rc","v3.0.0.1173rc","v3.0.0.1153rc","v3.0.0.1141rc","v3.0.0.1139rc","v3.0.0.1137rc","v3.0.0.1079rc","v3.0.0.1070rc","v3.0.0.1068rc","v3.0.0.1064rc","v3.0.0.1062rc","v3.0.0.1056rc","v3.0.0.986rc","v3.0.0.903rc","v3.0.0.981rc","v3.0.0.909rc","v3.0.0.907rc","v3.0.0.897rc","v3.0.0.884rc","v3.0.0.876rc","v3.0.0.870rc","v3.0.0.858rc","v3.0.0.851rc","v3.0.0.849rc","v3.0.0.829rc","v3.0.0.836rc","v3.0.0.821rc","v3.0.0.819rc","v3.0.0.798rc","v3.0.0.795rc","v3.0.0.793rc","v3.0.0.786rc","v3.0.0.782rc","v3.0.0.773rc","v3.0.0.767rc","v3.0.0.765rc","v3.0.0.691rc","v3.0.0.673rc","v3.0.0.671rc","v3.0.0.669rc","v3.0.0.659rc","v3.0.0.654rc","v3.0.0.652rc","v3.0.0.649rc","v3.0.0.647rc","v","v3.0.0.0rc"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14966.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"}]}