CVE-2026-12565
Path Traversal (Zip-Slip) in unarchive module
The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GNU tar) which varies by platform. While CVE-2025-10284 addressed git-specific RCE vectors, the underlying archive extraction path traversal was never fixed. On systems with GNU tar < 1.34 (Ubuntu 20.04, Debian Buster, CentOS 7, many Docker base images), a malicious archive can write files outside the intended extraction directory.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Path Traversal (Zip-Slip) in unarchive module
The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GNU tar) which varies by platform. While CVE-2025-10284 addressed git-specific RCE vectors, the underlying archive extraction path traversal was never fixed. On systems with GNU tar < 1.34 (Ubuntu 20.04, Debian Buster, CentOS 7, many Docker base images), a malicious archive can write files outside the intended extraction directory.
- Record
CVE-2026-12565- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2026-37812
The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GNU tar) which varies by platform. While CVE-2025-10284 addressed git-specific RCE vectors, the underlying archive extraction path traversal was never fixed. On systems with GNU tar < 1.34 (Ubuntu 20.04, Debian Buster, CentOS 7, many Docker base images), a malicious archive can write files outside the intended extraction directory.
- Record
EUVD-2026-37812- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3vgw-585j-4m45
BBOT: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-10284
The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GNU tar) which varies by platform. While CVE-2025-10284 addressed git-specific RCE vectors, the underlying archive extraction path traversal was never fixed. On systems with GNU tar < 1.34 (Ubuntu 20.04, Debian Buster, CentOS 7, many Docker base images), a malicious archive can write files outside the intended extraction directory.
- Record
GHSA-3vgw-585j-4m45- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-22, CWE-61
- Updated
- 2026-11-02
NVD
The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GNU tar) which varies by platform. While CVE-2025-10284 addressed git-specific RCE vectors, the underlying archive extraction path traversal was never fixed. On systems with GNU tar < 1.34 (Ubuntu 20.04, Debian Buster, CentOS 7, many Docker base images), a malicious archive can write files outside the intended extraction directory.
- Record
CVE-2026-12565- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GNU tar) which varies by platform. While CVE-2025-10284 addressed git-specific RCE vectors, the underlying archive extraction path traversal was never fixed. On systems with GNU tar < 1.34 (Ubuntu 20.04, Debian Buster, CentOS 7, many Docker base images), a malicious archive can write files outside the intended extraction directory.
- Record
CVE-2026-12565- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-3vgw-585j-4m45
BBOT: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-10284
The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GNU tar) which varies by platform. While CVE-2025-10284 addressed git-specific RCE vectors, the underlying archive extraction path traversal was never fixed. On systems with GNU tar < 1.34 (Ubuntu 20.04, Debian Buster, CentOS 7, many Docker base images), a malicious archive can write files outside the intended extraction directory.
- Record
GHSA-3vgw-585j-4m45- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-22, CWE-61
- Updated
- 2026-11-02
OSVPYSEC-2026-2392
BBOT: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-10284
The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GNU tar) which varies by platform. While CVE-2025-10284 addressed git-specific RCE vectors, the underlying archive extraction path traversal was never fixed. On systems with GNU tar < 1.34 (Ubuntu 20.04, Debian Buster, CentOS 7, many Docker base images), a malicious archive can write files outside the intended extraction directory.
- Record
PYSEC-2026-2392- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bbotPyPI |
2.3.1 to 2.8.4 | 2.8.5 |
bbotPyPI |
2.3.1 up to 2.8.5, plus listed versions 2.3.1.5815rc02.3.1.5818rc02.3.1.5820rc02.3.22.3.2.5825rc0 Show 45 moreShow less2.3.2.5827rc02.3.2.5829rc02.3.2.5832rc02.3.2.5836rc02.3.2.5838rc02.3.2.5841rc02.3.2.5848rc02.3.2.5850rc02.3.2.5855rc02.3.2.5874rc02.3.2.5889rc02.3.2.5893rc02.3.2.5897rc02.3.2.5904rc02.3.2.5906rc02.3.2.5909rc02.3.2.5913rc02.3.2.5915rc02.3.2.5927rc02.3.2.5938rc02.3.2.5942rc02.3.2.5944rc02.3.2.5950rc02.3.2.5958rc02.3.2.5967rc02.3.2.5971rc02.4.02.4.0.5974rc02.4.0.5977rc02.4.0.5984rc02.4.0.5986rc02.4.0.5988rc02.4.0.5992rc02.4.0.5995rc02.4.0.5997rc02.4.0.5999rc02.4.0.6005rc02.4.0.6007rc02.4.0.6031rc02.4.0.6037rc02.4.0.6039rc02.4.0.6045rc02.4.0.6050rc02.4.0.6067rc02.4.0.6073rc0 |
2.8.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-12565 is a medium vulnerability (CVSS 5.3) in Black Lantern Security Bbot, published June 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in bbot 2.8.5.
References
Left out here: 167 versions. The JSON record has them.