Executive brief
BBOT, an OSINT automation framework, contains a flaw in how it handles compressed files during scans. When the tool automatically downloads and extracts archives, it may fail to block malicious symbolic links, allowing an attacker to place a link on the user's file system. This could potentially be used to trick the system or users into interacting with unintended file locations, though the impact is limited to creating the link itself.
Technical details
A vulnerability exists in BBOT's `unarchive` module due to improper validation of archive entries in ZIP and 7z formats. While the module intends to reject symbolic links, it fails to account for legacy `p7zip` output where DOS-attribute prefixes precede the Unix mode (e.g., "_ lrwxrwxrwx"). This allows an attacker-controlled symbolic link to bypass the safety check and be written to the extraction directory during a scan. The vulnerability is specifically triggered when BBOT extracts a malicious archive using a host with a legacy `p7zip` build. A fix has been implemented in the project's repository to correctly parse the trailing Unix mode field.
Affected products
- Black Lantern Security BBOT 2.3.1 to 2.8.6
Timeline
- 2026-07-08: advisory: NVD publication date
- 2026-07-08: disclosed