CVE
CVE-2025-10284
BBOT's various issues in unarchive.py can cause arbitrary file write and RCE
Summary
Various issues in bbot's unarchive.py allow a malicious site to cause bbot to write arbitrary files to arbitrary locations. This can be used to achieve Remote Code Execution (RCE).
Impact
A user who uses bbot to scan a malicious webserver may have arbitrary code executed on their system.
Package Versions Affected
Package Version
patch Availability
No items found.
Automatically patch vulnerabilities without upgrading
Fix Without Upgrading
Detect compatible fix
Apply safe remediation
Fix with a single pull request
CVSS Version
Severity
Base Score
CVSS Version
Score Vector
C
H
U
9.6
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
C
H
U
0
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
C
H
U
9.7
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Related Resources
No items found.
References
https://github.com/blacklanternsecurity/bbot/security/advisories/GHSA-fhw8-8v9p-7jp7, https://nvd.nist.gov/vuln/detail/CVE-2025-10284, https://github.com/blacklanternsecurity/bbot/commit/6325f2f4f8f6f4545703e4c9b8004e69f71bec82, https://blog.blacklanternsecurity.com/p/bbot-security-advisory-gitdumper, https://github.com/blacklanternsecurity/bbot, https://pypi.org/project/bbot, https://github.com/advisories/GHSA-fhw8-8v9p-7jp7