Executive brief
A vulnerability exists in the BBOT OSINT automation framework's archive handling module. If a user processes a malicious archive file, the tool may allow files to be written to unintended locations on the host system. This could lead to the corruption of system files or the placement of malicious scripts in sensitive directories, potentially compromising the security of the machine running the tool.
Technical details
A path traversal vulnerability (CWE-22) exists in the 'unarchive' internal module of BBOT. The module fails to perform code-level validation on extracted file paths, instead relying on external system tools like GNU tar. On systems running older versions of GNU tar (specifically versions prior to 1.34, common in older Linux distributions and Docker images), an attacker can craft a malicious archive that writes files outside of the intended extraction directory. This can be exploited if a user is induced to process a malicious archive through the tool. The issue was addressed in commit 4fb38fd by hardening the extraction process and adding size limits.
Affected products
- Black Lantern Security BBOT 2.3.1 to 2.8.4
Timeline
- 2026-06-17: disclosed
- 2026-06-17: advisory
- 2026-06-17: patched: Fixed in commit 4fb38fd6e