CVE-2026-14967— Black Lantern Security BBOT 路径遍历漏洞

Path traversal in github_workflows allows writing artifacts outside output directory

BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve `..`, so a crafted `CODE_REPOSITORY` URL could traverse out of the intended folder. The write is bounded to two directory levels above the output location and its target is determined by the operator's configuration, not the attacker.

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

对路径名的限制不恰当(路径遍历)

Black Lantern Security BBOT 路径遍历漏洞

Black Lantern Security BBOT是Black Lantern Security公司开源的一个递归互联网扫描器。 Black Lantern Security BBOT存在路径遍历漏洞，该漏洞源于github_workflows模块路径包含检查未解析“..”，导致特制CODE_REPOSITORY URL可能越出目标文件夹，造成路径遍历。以下版本受到影响：1.1.7版本至2.8.6版本。

N/A

N/A