Privilege Escalation in BleachBit for Windows

CVE-2026-55567

What is CVE-2026-55567?

BleachBit, a tool for freeing disk space and maintaining user privacy, has a vulnerability that allows a local unprivileged user to exploit the cleaning process. Prior to version 6.0.1, the application fails to properly lock and validate a target's parent directory before deletion. This oversight enables the user to replace the parent directory with a Windows junction and utilize a symlink to redirect a privileged deletion. Consequently, this could potentially lead to the unauthorized removal of sensitive files and allows the user to gain local SYSTEM privileges by leveraging Windows Installer behavior. This issue has been addressed in version 6.0.1.

References