Executive brief
A vulnerability exists in the BBOT security scanning tool's GitHub workflow module. A local attacker sharing the same system could trick the tool into writing data to unintended locations by placing a symbolic link where the tool expects to create a directory. This could lead to unauthorized file creation or modification on the local system, potentially disrupting operations or overwriting configuration files.
Technical details
The github_workflows module in BBOT (up to version 2.8.4) is vulnerable to an improper link resolution (CWE-59) flaw. The module constructs local directory paths using repository names without verifying if any path components are symbolic links. A local attacker with access to the scan directory can pre-plant a symlink at a predictable output path. When the tool executes, it follows the symlink, causing workflow data to be written to an attacker-chosen location. A fix was introduced in commit 16d9c42 which implements path validation to ensure no components between the trusted output directory and the target folder are symlinks.
Affected products
- Black Lantern Security BBOT 2.0.0 to 2.8.4
Timeline
- 2026-06-17: disclosed
- 2026-06-17: advisory
- 2026-06-17: patched: Fixed in commit 16d9c42b6