# CVE-2026-14967: Black Lantern Security BBOT path traversal in github_workflows module

Source: https://junglewise.ai/threats/cve-2026-14967-black-lantern-security-bbot-path-traversal-in-github-workflows  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-14967 · Severity: low · CVSS 3.1 · Published 2026-07-08

BBOT, an OSINT automation framework, contains a flaw in its GitHub Workflows module that could allow files to be saved in unintended locations on the operator's system. By providing a specially crafted repository URL, an attacker could trick the tool into writing downloaded data up to two directory levels outside of the designated output folder. While the attacker cannot choose the specific file name or destination—which are determined by the user's configuration—this could lead to minor data integrity issues or organizational clutter.

Technologies: [bbot (PyPI)](https://junglewise.ai/threats/technologies/bbot). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-14967 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14967 being exploited in the wild.

**How severe is CVE-2026-14967?** Low severity, with a CVSS score of 3.1, published 8 July 2026.

**Which products and versions are affected?** bbot (PyPI) ECOSYSTEM:introduced=1.1.7,fixed=3.0.0.

**Is there a fix for CVE-2026-14967?** Yes. bbot (PyPI): upgrade to 3.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14967 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-14967?** Check whether you run bbot (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- bbot (PyPI): upgrade to 3.0.0 or later

  ```sh
  pip install "bbot>=3.0.0"
  ```


## Technical details

A path traversal vulnerability (CWE-22) exists in the `github_workflows` module of BBOT due to insufficient validation of the `CODE_REPOSITORY` URL. The path-containment check failed to resolve dot-dot (`..`) sequences before validation, allowing a crafted URL to escape the intended output directory. The exploit is limited to two directory levels above the configured output location, and the final target path is determined by the operator's configuration rather than direct attacker input. This requires the operator to interact with a malicious repository URL. The issue was addressed in a commit that ensures paths are resolved and filenames are sanitized before writing to disk.

## Affected products

- Black Lantern Security BBOT 1.1.7 to 2.8.6

## Identifiers

- CVE-2026-14967
- PYSEC-2026-3720

## Timeline

- 2026-07-08: advisory: NVD publication date
- 2026-07-08: disclosed: Vulnerability details published by Black Lantern Security

## References

- [https://github.com/blacklanternsecurity/bbot/commit/c1c6ec05ff998e2fba55a14d1026f12563ccd82f](https://github.com/blacklanternsecurity/bbot/commit/c1c6ec05ff998e2fba55a14d1026f12563ccd82f)

## Related threats

- [Black Lantern Security BBOT symbolic link bypass in unarchive module](https://junglewise.ai/threats/cve-2026-14966-black-lantern-security-bbot-symbolic-link-bypass-in-unarchive)
- [Black Lantern Security BBOT path traversal in postman_download module](https://junglewise.ai/threats/cve-2026-12568-black-lantern-security-bbot-path-traversal-in-postman-download)
- [Black Lantern Security BBOT symlink following in github_workflows](https://junglewise.ai/threats/cve-2026-12567-black-lantern-security-bbot-symlink-following-in-github-workflows)
- [Black Lantern Security BBOT SSRF in docker_pull module](https://junglewise.ai/threats/cve-2026-12566-black-lantern-security-bbot-ssrf-in-docker-pull-module)
- [Black Lantern Security BBOT path traversal in unarchive module](https://junglewise.ai/threats/cve-2026-12565-black-lantern-security-bbot-path-traversal-in-unarchive-module)