{"id":"CVE-2026-55567","published":"2026-09-21T15:17:29.793","lastModified":"2026-09-24T21:16:28.120","description":"BleachBit cleans files to free disk space and to maintain privacy. Prior to 6.0.1, privileged Windows cleaning does not lock and validate a target's parent directory before deletion. A local unprivileged user can replace that directory with a Windows junction and use a native symlink to redirect the elevated deletion to an attacker-selected file. The arbitrary privileged file deletion can be combined with Windows Installer behavior to obtain local SYSTEM privileges. This issue is fixed in version 6.0.1.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-367"],"vendors":[],"products":[],"references":[{"url":"https://github.com/bleachbit/bleachbit/commit/ee128238e92c7192f0c4d6406b1bd0cd9155e7e0","tags":[]},{"url":"https://github.com/bleachbit/bleachbit/pull/1774","tags":[]},{"url":"https://github.com/bleachbit/bleachbit/releases/tag/v6.0.1","tags":[]},{"url":"https://github.com/bleachbit/bleachbit/security/advisories/GHSA-vcjw-px28-5w94","tags":[]},{"url":"https://github.com/bleachbit/bleachbit/security/advisories/GHSA-vcjw-px28-5w94","tags":[]}],"exploitRefs":[{"url":"https://github.com/bleachbit/bleachbit/commit/ee128238e92c7192f0c4d6406b1bd0cd9155e7e0","tags":[]},{"url":"https://github.com/bleachbit/bleachbit/pull/1774","tags":[]},{"url":"https://github.com/bleachbit/bleachbit/releases/tag/v6.0.1","tags":[]},{"url":"https://github.com/bleachbit/bleachbit/security/advisories/GHSA-vcjw-px28-5w94","tags":[]},{"url":"https://github.com/bleachbit/bleachbit/security/advisories/GHSA-vcjw-px28-5w94","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows a local unprivileged user to replace a target directory with a Windows junction and symlink to redirect privileged file deletions to attacker-selected files, potentially obtaining SYSTEM privileges.","exploitability":"Exploitation requires local unprivileged access and the ability to manipulate directory structures. Precondition is the presence of a vulnerable BleachBit version prior to 6.0.1.","blast_radius":"If exploited, the attacker can gain full control over the system, leading to severe data loss and unauthorized access.","remediation":"Upgrade to BleachBit version 6.0.1 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","privilege-escalation","local-attack"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-07T08:44:44.843Z"}}