CVE-2026-55567: Bleachbit

High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days.

BleachBit cleans files to free disk space and to maintain privacy. Prior to 6.0.1, privileged Windows cleaning does not lock and validate a target's parent directory before deletion. A local unprivileged user can replace that directory with a Windows junction and use a native symlink to redirect the elevated deletion to an attacker-selected file. The arbitrary privileged file deletion can be combined with Windows Installer behavior to obtain local SYSTEM privileges. This issue is fixed in version 6.0.1.

Affected products

• Bleachbit Bleachbit: before 6.0.1 (fixed in 6.0.1)

Published 2026-09-21. Last modified 2026-09-24.