rootpwn

high · CVSS v3 7.8

CVE-2026-55567

BleachBit versions prior to 6.0.1 allow a local unprivileged user on Windows to delete arbitrary files with elevated privileges by manipulat

Overview

BleachBit versions prior to 6.0.1 allow a local unprivileged user on Windows to delete arbitrary files with elevated privileges by manipulating junctions and symlinks. The flaw can be leveraged to gain SYSTEM rights through Windows Installer behavior. It affects any Windows system running BleachBit before the 6.0.1 release.

Description

BleachBit cleans files to free disk space and to maintain privacy. Prior to 6.0.1, privileged Windows cleaning does not lock and validate a target's parent directory before deletion. A local unprivileged user can replace that directory with a Windows junction and use a native symlink to redirect the elevated deletion to an attacker-selected file. The arbitrary privileged file deletion can be combined with Windows Installer behavior to obtain local SYSTEM privileges. This issue is fixed in version 6.0.1.

Impact

The vulnerability compromises confidentiality, integrity, and availability of files on the affected system. Local users can delete or overwrite critical system files, potentially leading to privilege escalation. Defenders should be aware that any untrusted user could exploit this flaw to tamper with system integrity.

Remediation

Update BleachBit to version 6.0.1 or later. If an update is not immediately possible, disable BleachBit’s privileged cleaning feature or run it under a non-elevated account. Monitor for unexpected junctions or symlink usage and enforce least privilege on Windows systems.

Risk context

High severity with a CVSS v3 score of 7.8. No EPSS data is available, but the flaw remains exploitable until patched. Defenders should treat it as a high‑priority issue.

Affected products

  • BleachBit 5.x
  • BleachBit 6.0.0

Scores

Severity
high
CVSS v2
6.8
CVSS v3
7.8
CVSS v4
—
EPSS
—

privilege-escalation file-deletion symlink Windows BleachBit high-severity

← All CVEs

Related CVEs

high

CVE-2026-94144

A high‑severity SQL injection flaw exists in drogonframework’s ORM component, allowing remote attackers to inject arbitrary SQL via the makeCriteria function. The vulnerability is present in all drogon releases up to 1.9.13 and has been publicly exploited. Defenders should immediately update or patch the framework to mitigate the risk.

View analysis

high

CVE-2026-55071

MCP-for-Stata's ado_package_install tool concatenates user input into a Stata command string without sanitization, allowing attackers to inject newline characters and execute arbitrary OS commands. This flaw exists in versions prior to 1.19.0 and can be triggered via the MCP tool or its Python API. The vulnerability enables full OS‑level remote code execution under the server’s user account.

View analysis

high

CVE-2026-55074

Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's put_file resolved a transfer's destination to a path on the jail host ( + ) and ran mkdir -p and mv there as root on the host. Those commands follow symbolic links, and the path was operated on outside the jail, so a symlink existing inside the jail was followed by the host-side, root-privileged mv. A party controlling content inside a managed jail (the jail's root, or any process able to create a symlink in a directory an Ansible task later writes to) can therefore cause an arbitrary root-owned write on the host, outside the jail — a full jail escape. Arbitrary root-owned host writes are readily escalated to host compromise (e.g. cron, rc.d, authorized_keys). Preconditions for this vulnerability are that the operator runs a copy/template/fetch-style task (anything using put_file) against the jail, and the attacker can place a symlink inside the jail at or above the task's destination before the transfer runs. This issue has been fixed in version 2.0.0.

View analysis

high

CVE-2026-61628

nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act (TOCTOU) pattern between the "onboarding already completed?" check and the user-creation write, with no atomic guard, a remote unauthenticated attacker who can reach an instance in its pre-onboarding state can create an administrator account for themselves — and concurrent requests can create multiple admin accounts in a single race. Version 2.41.1 patches the issue.

View analysis