CVE-2026-14967 — Path traversal in github_workflows allows writing artifacts outside output directory
BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve `..`, so a c…
Published: 2026-07-08 · CVSS: 3.1 · CVSS 3.1
BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve `..`, so a crafted `CODE_REPOSITORY` URL could traverse out of the intended folder. The write is bounded to two directory levels above the output location and its target is determined by the operator's configuration, not the attacker.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7