TI-2026-10776 Aliases CVE-2026-12565 GHSA-3vgw-585j-4m45

Path Traversal (Zip-Slip) in unarchive module

LOW 23CWE-22Published 2026-06-17 · Updated 2026-06-18

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GNU tar) which varies by platform. While CVE-2025-10284 addressed git-specific RCE vectors, the underlying archive extraction path traversal was never fixed. On systems with GNU tar < 1.34 (Ubuntu 20.04, Debian Buster, CentOS 7, many Docker base images), a malicious archive can write files outside the intended extraction directory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00208 11th percentileScored 2026-11-07

Fix Fixed bbot (PyPI): 2.8.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Black Lantern Security	BBOT	2.3.1 – <=2.8.4	—	No fix listed	CNA
—	bbot (PyPI)	2.3.1 to before 2.8.5	2.8.5	Patch available	GHSA-3vgw-585j-4m45

BBOT VendorBlack Lantern Security Affected 2.3.1 – <=2.8.4 Fixed in — No fix listed CNA
bbot (PyPI) Vendor— Affected 2.3.1 to before 2.8.5 Fixed in 2.8.5 Patch available GHSA-3vgw-585j-4m45

Remediation

Fix · GHSA-3vgw-585j-4m45 bbot (PyPI) Fixed in 2.8.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-12565
2026-10-03 Alias added: GHSA-3vgw-585j-4m45

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-12565

Other 3

TI-2026-10779 Arbitrary File Write in postman_download module CVSS 3.1MEDIUM 6.5
TI-2026-12602 Path traversal in github_workflows allows writing artifacts outside output directory CVSS 3.1LOW 3.1
TI-2026-12601 Symlink guard bypass in unarchive module allows planting symlinks during extraction CVSS 3.1LOW 3.1
TI-2026-10777 SSRF via unvalidated WWW-Authenticate realm in docker_pull module CVSS 3.1LOW 3.1
TI-2026-10778 Symlink-following arbitrary write via github_workflows module CVSS 3.1LOW 2.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences