BleachBit versions prior to 6.0.1 on Windows allow an unprivileged user to replace the child’s parent directory with a junction and then use a native symlink to redirect the elevated deletion to an attacker‑selected file. This flaw permits deletion of arbitrary files with system privileges, and when combined with Windows Installer behavior it can lead to full SYSTEM privilege escalation. The vulnerability is an instance of Improper Privilege Management (CWE‑367) and can compromise confidentiality, integrity, and availability of the affected system.

BleachBit on Windows users running a version older than 6.0.1 are affected. The flaw exists in the Windows cleaning component of the tool and impacts any installation where the tool is run with elevated privileges.

The CVSS score is 7.8, indicating high risk for a local attacker. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. An attacker must be able to execute locally and create junctions or symlinks; no remote exploitation mechanism is reported. Once exploited, the attacker can delete any file or gain SYSTEM privileges, which represents a severe security breach.