Arbitrary File Write in postman_download module
Priority LOW 28CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
The postman_download module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, allowing an attacker to write arbitrary files to the user's system.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00251 16th percentileScored 2026-11-07
Fix Fixed bbot (PyPI): 2.8.6
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Black Lantern Security | BBOT | 2.1.0 – <=2.8.5 | — | No fix listed | CNA |
| — | bbot (PyPI) | 2.1.0 to before 2.8.6 | 2.8.6 | Patch available | GHSA-m54h-vhf9-3w3m |
- BBOT VendorBlack Lantern Security Affected 2.1.0 – <=2.8.5 Fixed in — No fix listed CNA
- bbot (PyPI) Vendor— Affected 2.1.0 to before 2.8.6 Fixed in 2.8.6 Patch available GHSA-m54h-vhf9-3w3m
Remediation
- Fix · GHSA-m54h-vhf9-3w3m bbot (PyPI) Fixed in 2.8.6 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-12568
- 2026-10-03 Alias added: GHSA-m54h-vhf9-3w3m
References
More Black Lantern Security vulnerabilities
- TI-2026-10776 Path Traversal (Zip-Slip) in unarchive module CVSS 3.1MEDIUM 5.3
- TI-2026-12602 Path traversal in github_workflows allows writing artifacts outside output directory CVSS 3.1LOW 3.1
- TI-2026-12601 Symlink guard bypass in unarchive module allows planting symlinks during extraction CVSS 3.1LOW 3.1
- TI-2026-10777 SSRF via unvalidated WWW-Authenticate realm in docker_pull module CVSS 3.1LOW 3.1
- TI-2026-10778 Symlink-following arbitrary write via github_workflows module CVSS 3.1LOW 2.2
Sources
- CVE-2026-12568 · CVE Program
- CVE-2026-12568 · NVD
- FIRST EPSS
- GHSA-m54h-vhf9-3w3m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences