Quick answers
- Is CVE-2026-12565 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-12565 being exploited in the wild.
- How severe is CVE-2026-12565?
- Medium severity, with a CVSS score of 5.3, published 17 June 2026.
- Which products and versions are affected?
- bbot (PyPI) >= 2.3.1, <= 2.8.4, ECOSYSTEM:introduced=2.3.1,fixed=2.8.5.
- Is there a fix for CVE-2026-12565?
- Yes. bbot (PyPI): upgrade to 2.8.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-12565 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-12565?
- Check whether you run bbot (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- bbot (PyPI): upgrade to 2.8.5 or later
pip install "bbot>=2.8.5"
Technical details
A path traversal vulnerability (CWE-22) exists in the 'unarchive' internal module of BBOT. The module fails to perform code-level validation on extracted file paths, instead relying on external system tools like GNU tar. On systems running older versions of GNU tar (specifically versions prior to 1.34, common in older Linux distributions and Docker images), an attacker can craft a malicious archive that writes files outside of the intended extraction directory. This can be exploited if a user is induced to process a malicious archive through the tool. The issue was addressed in commit 4fb38fd by hardening the extraction process and adding size limits.
Affected products
- Black Lantern Security BBOT 2.3.1 to 2.8.4
Identifiers
- CVE-2026-12565
- GHSA-3vgw-585j-4m45
- PYSEC-2026-2392
Timeline
- 2026-06-17: disclosed
- 2026-06-17: advisory
- 2026-06-17: patched: Fixed in commit 4fb38fd6e