CVE-2025-10284
published 2025-10-09CVE-2025-10284: BBOT's unarchive module could be abused by supplying malicious archives files and when extracted can then perform an arbitrary file write, resulting in remote…
PriorityP260critical9.6CVSS 3.1
AVNACLPRNUIRSCCHIHAH
EPSS
0.67%
47.2th percentile
BBOT's unarchive module could be abused by supplying malicious archives files and when extracted can then perform an arbitrary file write, resulting in remote code execution.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| black_lantern_security | bbot | >= 2.3.1 < 2.8.5 | 2.8.5 |
| black_lantern_security | bbot | 2.3.1 – <=2.8.4 | — |
| blsops_llc | bbot | >= 0 < 2.7.0 | 2.7.0 |
CVSS provenance
nvdv3.19.6CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
cvelistv5v3.19.6CRITICALCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
ghsa9.6CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
BBOT: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-10284
ghsa·2026-06-18·CVSS 9.6
CVE-2026-12565 [CRITICAL] CWE-22 BBOT: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-10284
BBOT: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-10284
The `unarchive` internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GNU tar) which varies by platform. While CVE-2025-10284 addressed git-specific RCE vectors, the underlying archive extraction path traversal was never fixed. On systems with GNU tar < 1.34 (Ubuntu 20.04, Debian Buster, CentOS 7, many Docker base images), a malicious archive can write files outside the intended extraction directory.
CVEList
Path Traversal (Zip-Slip) in unarchive module
cvelistv5·2026-06-17·CVSS 9.6
CVE-2026-12565 [CRITICAL] CWE-22 Path Traversal (Zip-Slip) in unarchive module
Path Traversal (Zip-Slip) in unarchive module
The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GNU tar) which varies by platform. While CVE-2025-10284 addressed git-specific RCE vectors, the underlying archive extraction path traversal was never fixed. On systems with GNU tar < 1.34 (Ubuntu 20.04, Debian Buster, CentOS 7, many Docker base images), a malicious archive can write files outside the intended extraction directory.
GHSA
BBOT's various issues in unarchive.py can cause arbitrary file write and RCE
ghsa·2025-10-09
CVE-2025-10284 [CRITICAL] CWE-22 BBOT's various issues in unarchive.py can cause arbitrary file write and RCE
BBOT's various issues in unarchive.py can cause arbitrary file write and RCE
### Summary
Various issues in bbot's `unarchive.py` allow a malicious site to cause bbot to write arbitrary files to arbitrary locations. This can be used to achieve Remote Code Execution (RCE).
### Impact
A user who uses bbot to scan a malicious webserver may have arbitrary code executed on their system.
OSV
BBOT's various issues in unarchive.py can cause arbitrary file write and RCE
osv·2025-10-09
CVE-2025-10284 [CRITICAL] BBOT's various issues in unarchive.py can cause arbitrary file write and RCE
BBOT's various issues in unarchive.py can cause arbitrary file write and RCE
### Summary
Various issues in bbot's `unarchive.py` allow a malicious site to cause bbot to write arbitrary files to arbitrary locations. This can be used to achieve Remote Code Execution (RCE).
### Impact
A user who uses bbot to scan a malicious webserver may have arbitrary code executed on their system.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-09
Published