liquidsec

4 exploits Active since Jun 2026
CVE-2026-12565 WRITEUP MEDIUM WRITEUP
Black Lantern Security BBOT - Path Traversal (Zip-Slip) in Unarchive Module
The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GNU tar) which varies by platform. While CVE-2025-10284 addressed git-specific RCE vectors, the underlying archive extraction path traversal was never fixed. On systems with GNU tar < 1.34 (Ubuntu 20.04, Debian Buster, CentOS 7, many Docker base images), a malicious archive can write files outside the intended extraction directory.
CVSS 5.3
CVE-2026-12566 WRITEUP LOW WRITEUP
SSRF via unvalidated WWW-Authenticate realm in docker_pull module
The docker_pull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint without validation. An attacker in a man-in-the-middle position between bbot and a Docker registry could modify this header to redirect the authentication request to an arbitrary endpoint, potentially leaking authentication tokens.
CVSS 3.1
CVE-2026-12567 WRITEUP LOW WRITEUP
Black Lantern Security BBOT - Symlink-Following Arbitrary Write via github_workflows Module
The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location.
CVSS 2.2
CVE-2026-12568 WRITEUP MEDIUM WRITEUP
Black Lantern Security BBOT - Arbitrary File Write in postman_download Module
The postman_download module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, allowing an attacker to write arbitrary files to the user's system.
CVSS 6.5