What is the CVSS score of CVE-2026-12565?

CVE-2026-12565 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-12565?

Yes, a public proof-of-concept exploit is available for CVE-2026-12565. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-12565?

Yes, a patch is available for CVE-2026-12565. Update the affected software to the latest version immediately.

BBOT CVE-2026-12565

Q: Which versions of BBOT are affected by CVE-2026-12565?

Path traversal in BBOT's unarchive internal module enables a malicious archive hosted by attacker-controlled infrastructure to write files outside the intended extraction directory when BBOT runs on…. A patch is available.

EUVD-2026-37812 MEDIUM

Path Traversal (CWE-22)

2026-06-17 BLSOPS

GHSA-3vgw-585j-4m45

Path Traversal Debian Ubuntu Docker Bbot

5.3

CVSS 3.1 · Vendor: BLSOPS

Severity by source

Vendor (BLSOPS) PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

5.3 MEDIUM

AV:N because BBOT fetches archives from internet targets; AC:H because exploitation requires GNU tar < 1.34 specifically; UI:R because a BBOT operator must initiate the scan; I:H for arbitrary out-of-directory file write; no confidentiality or availability impact from path traversal alone.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (BLSOPS).

CVSS VectorVendor: BLSOPS

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 17, 2026 - 23:01 vuln.today

Analysis Generated

Jun 17, 2026 - 23:01 vuln.today

DescriptionCVE.org

The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GNU tar) which varies by platform. While CVE-2025-10284 addressed git-specific RCE vectors, the underlying archive extraction path traversal was never fixed. On systems with GNU tar < 1.34 (Ubuntu 20.04, Debian Buster, CentOS 7, many Docker base images), a malicious archive can write files outside the intended extraction directory.

AnalysisAI

Path traversal in BBOT's unarchive internal module enables a malicious archive hosted by attacker-controlled infrastructure to write files outside the intended extraction directory when BBOT runs on systems with GNU tar < 1.34. This vulnerability is a residual gap from CVE-2025-10284, which resolved git-specific RCE vectors but left the underlying archive extraction path validation entirely unimplemented, relying instead on inconsistent external tool behavior across platforms. No public exploit has been identified at time of analysis; the CVSS vector (AC:H/UI:R) constrains real-world risk to BBOT operators actively scanning attacker-controlled targets on affected OS distributions, but the high integrity impact (I:H) and zero privilege requirement (PR:N) are significant for red-team and CI/CD BBOT deployments running on legacy base images.

Technical ContextAI

BBOT (Black Lantern Security BBOT, CPE: cpe:2.3:a:black_lantern_security:bbot:*:*:*:*:*:*:*:*) is an automated OSINT and attack surface reconnaissance framework. Its internal 'unarchive' module handles extraction of archives discovered during scanning by delegating to system-level tools such as GNU tar rather than implementing extraction natively in Python with path sanitization. CWE-22 (Path Traversal) arises because archive entries containing directory escape sequences (e.g., '../../') are passed directly to GNU tar without stripping or validating that resolved output paths remain under the intended extraction root. GNU tar versions >= 1.34 introduced a default '--one-top-level' or equivalent safe extraction behavior that implicitly mitigates this; versions < 1.34 - shipped by default on Ubuntu 20.04 (Focal), Debian Buster (10), CentOS 7, and many Docker base images derived from those distributions - do not strip traversal sequences, making file write outside the extraction directory possible.

RemediationAI

The referenced upstream commit at https://github.com/blacklanternsecurity/bbot/commit/4fb38fd6e should be applied; however, no explicitly tagged patched release version is confirmed from the available data - the fix is available as a commit but a released version number has not been independently verified from the provided references. As a compensating control, upgrading GNU tar to >= 1.34 on any host running BBOT mitigates the path traversal primitive by leveraging tar's built-in safe extraction behavior; this is achievable on Ubuntu 20.04 by installing a backported tar package or switching to a newer base image (ubuntu:22.04 or debian:11+). For Docker-based BBOT deployments, rebuilding base images from debian:bullseye or ubuntu:jammy eliminates the vulnerable tar version. Operators should also avoid running BBOT scans against untrusted or attacker-controlled targets under accounts with write access to sensitive directories (SSH keys, cron, web roots). Restricting BBOT's extraction output directory to a sandboxed, ephemeral volume reduces blast radius if path traversal succeeds. The pickle deserialization fix in the same commit is also critical and should be treated as a separate high-priority remediation for cache integrity.