EUVD-2026-37818
GHSA-m54h-vhf9-3w3m
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attacker controls only a network-hosted Postman workspace name requiring no victim-system privileges; victim must actively run the module (UI:R); impact is filesystem write-only with no confidentiality or availability effect.
Primary rating from Vendor (BLSOPS).
CVSS VectorVendor: BLSOPS
Lifecycle Timeline
2DescriptionCVE.org
The postman_download module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, allowing an attacker to write arbitrary files to the user's system.
AnalysisAI
Arbitrary file write in BBOT's postman_download module enables a remote attacker to write files outside the intended output directory on a victim's system by controlling a Postman workspace name containing path traversal sequences. When a user runs the postman_download module, BBOT fetches workspace names from the Postman API and constructs local filesystem paths without sanitization, allowing pathlib to resolve paths into arbitrary locations on the victim's host. No public exploit has been identified at time of analysis, though the attack primitive is straightforward given the publicly committed fix details and low attack complexity.
Technical ContextAI
BBOT (Black Lantern Security's Bug Bounty and Recon Tool) includes a postman_download module that queries the Postman API and uses the returned workspace name directly to construct local directory paths via Python's pathlib. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal): the workspace name, an externally controlled string, was concatenated with a base output directory path with no sanitization or canonical-path boundary check. Python's pathlib does not strip or reject traversal sequences such as '../', so a workspace named '../../.ssh' resolves cleanly to a parent directory outside the intended output path. The same flaw existed for collection names in the save_workspace method. All versions of cpe:2.3:a:black_lantern_security:bbot:*:*:*:*:*:*:*:* are affected up to upstream commit 36bc20818, which introduces helpers.tagify() sanitization and an explicit resolve()/is_relative_to() boundary guard.
RemediationAI
Users should update BBOT to a version incorporating upstream commit 36bc20818 (https://github.com/blacklanternsecurity/bbot/commit/36bc20818) as soon as a tagged release is available, or pin to the patched commit directly. The fix applies helpers.tagify() to sanitize workspace and collection names before path construction, and adds a resolve()/is_relative_to() guard that skips any workspace whose name resolves outside the intended output directory. As a compensating control prior to patching, avoid running the postman_download module against untrusted or externally controlled Postman workspaces; if the module must be used, execute BBOT inside a sandboxed or containerized environment with a restricted output directory to limit the filesystem locations reachable via traversal. Do not run BBOT as root when using this module, as elevated privileges dramatically increase the potential impact of a successful path traversal. A confirmed fixed release version is not independently verifiable from available data - upstream fix available via commit only.
Path traversal in BBOT's unarchive internal module enables a malicious archive hosted by attacker-controlled infrastruct
Authentication token leakage in Black Lantern Security's bbot docker_pull module exposes Docker credentials to MITM atta
Symlink-following path traversal in BBOT's github_workflows module (all versions prior to commit 16d9c42b6) allows a loc
Symlink extraction bypass in BBOT's unarchive module allows an attacker to plant an attacker-controlled symlink into the
Path traversal in BBOT's github_workflows module allows a crafted CODE_REPOSITORY URL to write a downloaded artifact out
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today