CVE-2026-12565
published 2026-06-17CVE-2026-12565: The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of…
PriorityP432medium5.3CVSS 3.1
AVNACHPRNUIRSUCNIHAN
EPSS
0.21%
11.0th percentile
The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GNU tar) which varies by platform. While CVE-2025-10284 addressed git-specific RCE vectors, the underlying archive extraction path traversal was never fixed. On systems with GNU tar < 1.34 (Ubuntu 20.04, Debian Buster, CentOS 7, many Docker base images), a malicious archive can write files outside the intended extraction directory.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| black_lantern_security | bbot | >= 2.3.1 < 2.8.5 | 2.8.5 |
| black_lantern_security | bbot | 2.3.1 – <=2.8.4 | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
cvelistv5v3.19.6CRITICALCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
ghsa9.6CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
BBOT: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-10284
ghsa·2026-06-18·CVSS 9.6
CVE-2026-12565 [CRITICAL] CWE-22 BBOT: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-10284
BBOT: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-10284
The `unarchive` internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GNU tar) which varies by platform. While CVE-2025-10284 addressed git-specific RCE vectors, the underlying archive extraction path traversal was never fixed. On systems with GNU tar < 1.34 (Ubuntu 20.04, Debian Buster, CentOS 7, many Docker base images), a malicious archive can write files outside the intended extraction directory.
CVEList
Path Traversal (Zip-Slip) in unarchive module
cvelistv5·2026-06-17·CVSS 9.6
CVE-2026-12565 [CRITICAL] CWE-22 Path Traversal (Zip-Slip) in unarchive module
Path Traversal (Zip-Slip) in unarchive module
The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GNU tar) which varies by platform. While CVE-2025-10284 addressed git-specific RCE vectors, the underlying archive extraction path traversal was never fixed. On systems with GNU tar < 1.34 (Ubuntu 20.04, Debian Buster, CentOS 7, many Docker base images), a malicious archive can write files outside the intended extraction directory.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-17
Published