{"id":"CVE-2026-55567","published":"2026-09-21T15:17:29.793","lastModified":"2026-09-21T16:17:09.557","description":"BleachBit cleans files to free disk space and to maintain privacy. Prior to 6.0.1, privileged Windows cleaning does not lock and validate a target's parent directory before deletion. A local unprivileged user can replace that directory with a Windows junction and use a native symlink to redirect the elevated deletion to an attacker-selected file. The arbitrary privileged file deletion can be combined with Windows Installer behavior to obtain local SYSTEM privileges. This issue is fixed in version 6.0.1.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-367"],"vendors":[],"products":[],"references":[{"url":"https://github.com/bleachbit/bleachbit/commit/ee128238e92c7192f0c4d6406b1bd0cd9155e7e0","tags":[]},{"url":"https://github.com/bleachbit/bleachbit/pull/1774","tags":[]},{"url":"https://github.com/bleachbit/bleachbit/releases/tag/v6.0.1","tags":[]},{"url":"https://github.com/bleachbit/bleachbit/security/advisories/GHSA-vcjw-px28-5w94","tags":[]},{"url":"https://github.com/bleachbit/bleachbit/security/advisories/GHSA-vcjw-px28-5w94","tags":[]}],"exploitRefs":[{"url":"https://github.com/bleachbit/bleachbit/commit/ee128238e92c7192f0c4d6406b1bd0cd9155e7e0","tags":[]},{"url":"https://github.com/bleachbit/bleachbit/pull/1774","tags":[]},{"url":"https://github.com/bleachbit/bleachbit/releases/tag/v6.0.1","tags":[]},{"url":"https://github.com/bleachbit/bleachbit/security/advisories/GHSA-vcjw-px28-5w94","tags":[]},{"url":"https://github.com/bleachbit/bleachbit/security/advisories/GHSA-vcjw-px28-5w94","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows a local unprivileged user to replace a target directory with a Windows junction and symlink, enabling arbitrary privileged file deletion which can lead to SYSTEM privileges.","exploitability":"Exploitation requires preconditions such as access to a vulnerable BleachBit version and the ability to manipulate directory structures; moderately hard.","blast_radius":"If exploited, it could result in full system compromise for the affected machine.","remediation":"Update BleachBit to version 6.0.1 or later immediately.","tags":["local-privilege-escalation","file-deletion","junction","symlink"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-22T06:09:44.305Z"}}