Vulnerability · Published Jun 17, 2026 · Assigned by BLSOPS
CVE-2026-12565Path Traversal (Zip-Slip) in unarchive module
Medium 5.3
In plain English
A medium-severity path traversal in BBOT from Black Lantern Security. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GNU tar) which varies by platform. While CVE-2025-10284 addressed git-specific RCE vectors, the underlying archive extraction path traversal was never fixed. On systems with GNU tar < 1.34 (Ubuntu 20.04, Debian Buster, CentOS 7, many Docker base images), a malicious archive can write files outside the intended extraction directory.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | bbot | 2.8.5 | GHSA-3vgw-585j-4m45 |
| PyPI | bbot | 2.8.5 | PYSEC-2026-2392 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Black Lantern Security | BBOT | 2.3.1 – through <=2.8.4 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N