# CVE-2026-12567: Black Lantern Security BBOT symlink following in github_workflows

Source: https://junglewise.ai/threats/cve-2026-12567-black-lantern-security-bbot-symlink-following-in-github-workflows  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-12567 · Severity: low · CVSS 3.1 · Published 2026-06-17

A vulnerability exists in the BBOT security scanning tool's GitHub workflow module. A local attacker sharing the same system could trick the tool into writing data to unintended locations by placing a symbolic link where the tool expects to create a directory. This could lead to unauthorized file creation or modification on the local system, potentially disrupting operations or overwriting configuration files.

Technologies: [bbot (PyPI)](https://junglewise.ai/threats/technologies/bbot). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-12567 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12567 being exploited in the wild.

**How severe is CVE-2026-12567?** Low severity, with a CVSS score of 3.1, published 17 June 2026.

**Which products and versions are affected?** bbot (PyPI) >= 2.0.0, <= 2.8.4, ECOSYSTEM:introduced=2.0.0,fixed=2.8.5.

**Is there a fix for CVE-2026-12567?** Yes. bbot (PyPI): upgrade to 2.8.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12567 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-12567?** Check whether you run bbot (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- bbot (PyPI): upgrade to 2.8.5 or later

  ```sh
  pip install "bbot>=2.8.5"
  ```


## Technical details

The github_workflows module in BBOT (up to version 2.8.4) is vulnerable to an improper link resolution (CWE-59) flaw. The module constructs local directory paths using repository names without verifying if any path components are symbolic links. A local attacker with access to the scan directory can pre-plant a symlink at a predictable output path. When the tool executes, it follows the symlink, causing workflow data to be written to an attacker-chosen location. A fix was introduced in commit 16d9c42 which implements path validation to ensure no components between the trusted output directory and the target folder are symlinks.

## Affected products

- Black Lantern Security BBOT 2.0.0 to 2.8.4

## Identifiers

- CVE-2026-12567
- GHSA-rvp7-w75q-9fv2
- PYSEC-2026-2394

## Timeline

- 2026-06-17: disclosed
- 2026-06-17: advisory
- 2026-06-17: patched: Fixed in commit 16d9c42b6

## References

- [https://github.com/blacklanternsecurity/bbot/commit/16d9c42b6](https://github.com/blacklanternsecurity/bbot/commit/16d9c42b6)

## Related threats

- [Black Lantern Security BBOT path traversal in github_workflows module](https://junglewise.ai/threats/cve-2026-14967-black-lantern-security-bbot-path-traversal-in-github-workflows)
- [Black Lantern Security BBOT symbolic link bypass in unarchive module](https://junglewise.ai/threats/cve-2026-14966-black-lantern-security-bbot-symbolic-link-bypass-in-unarchive)
- [Black Lantern Security BBOT path traversal in postman_download module](https://junglewise.ai/threats/cve-2026-12568-black-lantern-security-bbot-path-traversal-in-postman-download)
- [Black Lantern Security BBOT SSRF in docker_pull module](https://junglewise.ai/threats/cve-2026-12566-black-lantern-security-bbot-ssrf-in-docker-pull-module)
- [Black Lantern Security BBOT path traversal in unarchive module](https://junglewise.ai/threats/cve-2026-12565-black-lantern-security-bbot-path-traversal-in-unarchive-module)