BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve `..`, so a crafted `CODE_REPOSITORY` URL could traverse…
BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produc…
CVSS 3.1LOW 3.1·Network·No auth·User interaction·EPSS 0.00384·Published 2026-07-08·Fixed in 3.0.0CWE-59
