Is CVE-2026-55567 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-55567?

CVE-2026-55567 has a CVSS v3 severity of HIGH (7.8).

Back

CVE-2026-55567

Description

BleachBit cleans files to free disk space and to maintain privacy. Prior to 6.0.1, privileged Windows cleaning does not lock and validate a target's parent directory before deletion. A local unprivileged user can replace that directory with a Windows junction and use a native symlink to redirect the elevated deletion to an attacker-selected file. The arbitrary privileged file deletion can be combined with Windows Installer behavior to obtain local SYSTEM privileges. This issue is fixed in version 6.0.1.