Black Lantern Security BBOT vulnerabilities

Latest Black Lantern Security BBOT CVEs

Newest publication first

1. CVE-2026-14967 Path traversal in github_workflows allows writing artifacts outside output directory

   Published 2026-07-08

   Low·CVSS 3.1 EPSS 0.26%

   BBOT's github_workflows module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve .., so a crafted CODE_REPOSITORY URL could traverse out of the intended folder. The write is bounded to two directory...

2. CVE-2026-14966 Symlink guard bypass in unarchive module allows planting symlinks during extraction

   Published 2026-07-08

   Low·CVSS 3.1 EPSS 0.38%

   BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produced by legacy versions of p7zip. Such an archive, downloaded...

3. CVE-2026-12568 Arbitrary File Write in postman_download module

   Published 2026-06-17

   Medium·CVSS 6.5 EPSS 0.25%

   The postman_download module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, al...

4. CVE-2026-12567 Symlink-following arbitrary write via github_workflows module

   Published 2026-06-17

   Low·CVSS 2.2 EPSS 0.09%

   The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-c...

5. CVE-2026-12566 SSRF via unvalidated WWW-Authenticate realm in docker_pull module

   Published 2026-06-17

   Low·CVSS 3.1 EPSS 0.17%

   The docker_pull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint without validation. An attacker in a man-in-the-middle position between bbot and a Docker registry could modify this header to redirect the aut...

6. CVE-2026-12565 Path Traversal (Zip-Slip) in unarchive module

   Published 2026-06-17

   Medium·CVSS 5.3 EPSS 0.21%

   The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GNU tar) which varies by platform. While CVE-2025-10284 addressed git-specific RCE vectors, the underlyin...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.