CVE-2026-12567

published 2026-06-17

CVE-2026-12567: The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing…

Priority P4 10 low 2.2 CVSS 3.1

AV L AC H PR L UI R S U C N I L A N

The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
black_lantern_security	bbot	>= 2.0.0 < 2.8.5	2.8.5
black_lantern_security	bbot	2.0.0 – <=2.8.4	—

CVSS provenance

nvd v3.1 2.2 LOW CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

cvelistv5 v3.1 2.2 LOW CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-59 CWE-22