Privileged Directory Deletion via Junction Point Hijacking

BleachBit cleans files to free disk space and to maintain privacy. Prior to 6.0.1, privileged Windows cleaning does not lock and validate a target's parent directory before deletion. A local unprivileged user can replace that directory with a Windows junction and use a native symlink to redirect the elevated deletion to an attacker-selected file. The arbitrary privileged file deletion can be combined with Windows Installer behavior to obtain local SYSTEM privileges. This issue is fixed in version 6.0.1.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

BleachBit versions prior to 6.0.1 suffer from a critical privilege escalation vulnerability where elevated file deletion operations fail to properly validate parent directories before removal. An unprivileged local attacker can exploit this by replacing the target directory with a Windows junction—a symbolic link that redirects the privileged deletion to an attacker-chosen file. By chaining this arbitrary file deletion with Windows Installer's trusted execution context, an attacker can escalate privileges to SYSTEM level. This vulnerability affects any Windows user running vulnerable BleachBit versions, particularly in enterprise environments where disk cleanup utilities are commonly deployed or where privileged cleanup tasks run automatically.

Casky's 224 mapped skills detect the attack patterns underlying this vulnerability by analyzing Privilege Escalation (TA0004) techniques through Claude's extended reasoning. Practitioners would observe detection signals across multiple attack stages: the creation of NTFS junction points and symbolic links (CWE-367: Time-of-Check-Time-of-Use race condition), unexpected parent directory modifications, and elevated process activity targeting file system objects not matching their expected paths. The platform's skill set identifies suspicious elevation chains where unprivileged processes trigger privileged operations on attacker-controlled symbolic links, followed by Windows Installer invocation patterns that complete the privilege escalation chain. Security teams would see correlated findings showing directory enumeration, junction creation, and subsequent SYSTEM-level file operations—a behavioral pattern diagnostic of this specific exploitation technique.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-55567.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-55567

Casky has 224 skills that investigate the attack patterns behind CVE-2026-55567. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn