CVE-2026-55567: BleachBit Windows Junction Flaw Enables Privilege Escalation

Overview

A local privilege escalation vulnerability has been disclosed in BleachBit, the popular open-source disk-cleaning and privacy tool. Tracked as CVE-2026-55567, the flaw allows a low-privileged local user on Windows to trick BleachBit's elevated-privilege cleaning routines into deleting arbitrary files — including files under C:\Windows — by pre-staging a directory junction before an admin-initiated clean runs.

The issue carries a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was credited to researcher Zeze of TeamT5.

Technical Details

How It Works

Prior to version 6.0.1, BleachBit's privileged Windows cleaning routines did not lock or validate a target directory's parent before deleting its contents. A local unprivileged user could replace a directory that BleachBit is configured to clean — for example a world-writable temp path — with a Windows junction, then chain a native filesystem symlink to redirect BleachBit's delete operation to an arbitrary target.

When an administrator (or a scheduled task) subsequently runs BleachBit with elevated privileges to clean that path, the tool follows the junction/reparse point instead of refusing to act on it, and deletes whatever file the attacker pointed it at — including files with elevated privileges under C:\Windows. Because the delete happens in the context of the elevated BleachBit process, this can be leveraged toward local privilege escalation (for example, by clearing files that block a subsequent DLL-hijack or service-replacement chain).

Impact Assessment

Who Is At Risk

• Systems where BleachBit is run with administrator privileges (interactively or via a scheduled task) to clean shared or user-writable directories
• Multi-user Windows systems where low-privileged accounts can write to paths that a privileged BleachBit job later cleans
• Managed endpoints where BleachBit is bundled into automated maintenance scripts running as SYSTEM or an admin account

Attack Chain

1. Local Access — Attacker has any local unprivileged account on the target
2. Junction Staging — Attacker replaces a to-be-cleaned directory with a Windows junction pointing at a sensitive location
3. Privileged Clean Triggered — An admin or scheduled task runs BleachBit with elevated rights
4. Arbitrary Delete — BleachBit follows the junction and deletes the attacker-chosen file with elevated privileges
5. Escalation — The deleted file's absence is leveraged to escalate privileges or disrupt security tooling

Mitigation

Immediate Actions

• Update to BleachBit 6.0.2 or later, which fixes CVE-2026-55567 directly; 6.0.3+ adds broader cross-platform symlink/reparse-point hardening across delete, wipe, and truncate code paths
• Avoid running BleachBit with elevated privileges against directories writable by lower-privileged users
• Audit scheduled tasks or maintenance scripts that invoke BleachBit as SYSTEM or an administrator

Detection Opportunities

• Monitor for creation of unexpected NTFS junctions or reparse points in directories targeted by cleaning jobs
• Review file-system audit logs for deletions of sensitive files correlated with BleachBit process execution
• Flag privileged processes that follow reparse points into unexpected target paths

Defence-in-Depth

• Apply least privilege to any automated cleaning/maintenance tooling — avoid SYSTEM/admin context where not strictly required
• Restrict write access to directories referenced by privileged scheduled tasks
• Keep endpoint software, including maintenance and privacy utilities, on a regular patch cadence

Fix Timeline

• BleachBit 6.0.1 beta — initial fix for the Windows-specific junction issue (commit ee128238)
• BleachBit 6.0.2 — stable release incorporating the CVE-2026-55567 fix
• BleachBit 6.0.3 — broader symlink/reparse-point guards (O_NOFOLLOW, lchown-equivalent checks) applied across file truncation, wiping, deep-scan, and config-write code paths on all platforms
• BleachBit 6.0.4 (September 8, 2026) — current stable release, includes all of the above

References

• BleachBit Security Advisory GHSA-vcjw-px28-5w94
• BleachBit Releases
• NVD — CVE-2026-55567