Description

BleachBit cleans files to free disk space and to maintain privacy. Prior to 6.0.1, privileged Windows cleaning does not lock and validate a target's parent directory before deletion. A local unprivileged user can replace that directory with a Windows junction and use a native symlink to redirect the elevated deletion to an attacker-selected file. The arbitrary privileged file deletion can be combined with Windows Installer behavior to obtain local SYSTEM privileges. This issue is fixed in version 6.0.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-21T15:17:29.793Z",
  "pubdate": "2026-09-21T15:17:29.793Z",
  "executiveSummary": "BleachBit versions prior to 6.0.1 are susceptible to an arbitrary file deletion vulnerability resulting from a Time-of-Check to Time-of-Use (TOCTOU) race condition during privileged cleanup operations on Windows.\nThe vulnerability resides in the application's failure to properly lock and validate target parent directories before executing file deletion routines.\nA local, unprivileged attacker can exploit this weakness by manipulating directory structures using Windows junctions and symlinks, effectively tricking the elevated BleachBit process into deleting arbitrary files within the system.\nThis vulnerability presents a critical security risk as it can be leveraged in conjunction with native Windows Installer behaviors to achieve local privilege escalation to SYSTEM level.\nExploitation requires local access to the target machine and the ability to influence the file system structure within the context of the elevated cleanup process.",
  "technicalDetails": "The vulnerability is rooted in an insecure file handling implementation within BleachBit's privileged cleaning module on Windows platforms. Prior to version 6.0.1, the application fails to perform atomic validation of target directories, leaving the cleanup process susceptible to race conditions.\nThe root cause is the absence of directory locking and canonicalization validation before the deletion function is invoked. During a cleanup task, the elevated process identifies a target directory for deletion but does not enforce a lock on the parent directory or verify that the directory has not been altered between the identification phase and the actual deletion phase.\nAn unprivileged local attacker can exploit this design flaw through a symlink/junction attack. By monitoring the file system for expected cleanup operations, an attacker can replace an intended target directory with a Windows junction pointing to a sensitive system location. Alternatively, the attacker can leverage Windows symlinks to redirect file system API calls.\nThe attack flow proceeds as follows: 1) The attacker identifies a directory that BleachBit is scheduled to clear with elevated privileges. 2) The attacker places a junction or symlink at the expected location before the deletion logic triggers. 3) The BleachBit process, running with SYSTEM or administrator-level privileges, follows the redirection and performs the deletion operation on a target file chosen by the attacker rather than the intended temporary file.\nThis behavior facilitates arbitrary file deletion, which can be weaponized to bypass security controls, corrupt system binaries, or interfere with Windows Installer processes. By deleting specific configuration files or components required by the Windows Installer, an attacker can trigger predictable error-handling sequences that result in the execution of arbitrary code with SYSTEM privileges.\nThis vulnerability affects all BleachBit installations on Windows below version 6.0.1. Because the deletion is performed by a privileged service, the attack requires no prior elevated privileges on the part of the attacker, though it requires sufficient local access to create and manipulate junctions/symlinks within reachable paths."
}