BBOT's various issues in unarchive.py can cause arbitrary file write and RCE

CRITICAL 9.6CVE-2025-10284 · GHSA-fhw8-8v9p-7jp7 · PYSEC-2026-292 · Published 09/10/2025 · updated 08/10/2026

Package	Affected versions	Patched versions
bbot PyPI	`< 2.7.0`	`2.7.0`

Description

Summary

Various issues in bbot's unarchive.py allow a malicious site to cause bbot to write arbitrary files to arbitrary locations. This can be used to achieve Remote Code Execution (RCE).

Impact

A user who uses bbot to scan a malicious webserver may have arbitrary code executed on their system.

NVD description

BBOT's unarchive module could be abused by supplying malicious archives files and when extracted can then perform an arbitrary file write, resulting in remote code execution.

References

blacklanternsecurity/bbot security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-10284 · ADVISORY
blacklanternsecurity/bbot commit 6325f2f · WEB
blog.blacklanternsecurity.com/p/bbot-security-advisory-gitdumper · WEB
blacklanternsecurity/bbot · PACKAGE
pypa/advisory-database · WEB
pypi.org/project/bbot · WEB
GitHub Advisory GHSA-fhw8-8v9p-7jp7 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free