The BBOT unarchive module attempts to reject archives containing symlink entries before extraction to prevent link following issues. However, for zip and 7z archives produced by legacy p7zip versions, the module fails to detect symlinks that have a DOS-attribute prefix before the unix mode in their listing. This bypass allows an attacker to place a symlink controlled by them into the extraction directory during archive extraction, such as during a filedownload scan. The vulnerability is limited to planting the symlink itself; the symlink's target is not overwritten or written through. The issue only affects BBOT versions 2.3.1 through 2.8.6 on hosts using legacy p7zip builds. Current mainline 7-Zip versions are not affected. There is no vendor-provided patch or remediation guidance available at this time.

An attacker can cause BBOT to write an attacker-controlled symlink into the extraction directory by exploiting improper detection of symlinks in certain archive formats. This could potentially be used to influence subsequent file operations that follow symlinks, but the vulnerability does not allow direct overwriting of symlink targets during extraction. The impact is limited to symlink planting and does not affect confidentiality or availability. The CVSS score is 3.1 (low severity), reflecting limited impact and the requirement for user interaction (UI:R) and high attack complexity (AC:H).

No official patch or remediation level has been provided by the vendor. Since the vulnerability depends on using legacy p7zip builds that produce archives with a DOS-attribute prefix, avoiding such legacy archive formats or upgrading to current mainline 7-Zip versions may mitigate the risk. Monitor vendor advisories for any forthcoming patches or official guidance. No immediate action is mandated by the vendor at this time.