BBOT’s unarchive module rejects archives that contain symlink entries before extraction, but it fails to detect symlinks whose listing carries a DOS‑attribute prefix before the Unix mode as produced by legacy p7zip builds. This flaw allows an attacker to craft a zip or 7z archive that bypasses the guard and causes an attacker‑controlled symlink to be created in the extraction directory. The CWE‑59 weakness stems from insufficient validation of file paths during extraction. The effect is limited to planting the symlink; the target path is not written, so the vulnerability does not directly leak data or grant code execution, but it can redirect subsequent file accesses to an attacker‑controlled location.

The vulnerability exists in Black Lantern Security:BBOT’s unarchive component when it uses p7zip prior to the mainline 7‑Zip release. Hosts running the legacy p7zip build are at risk; current mainline 7‑Zip is not. No specific BBOT product version is listed in the advisory.

The CVSS score of 3.1 indicates low severity, and the EPSS score of less than 1% reflects a very low probability of exploitation. This vulnerability is not listed in the CISA KEV catalog. Attackers must supply a malicious zip or 7z archive that is extracted by the BBOT process, such as during an automated filedownload scan. The flaw resides in a third‑party compression library and applies only to environments that accept untrusted archives and run the legacy p7zip build. The attack results in a symlink being planted in the extraction directory; it does not write the target file, so it does not directly compromise data or code, but it can redirect future file accesses to an attacker‑controlled location.