Kurz gesagt
- CVE-2026-12568 ist eine Schwachstelle (MITTEL (CVSS 6.5)) in bbot.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.25%, höher als bei 16.5% aller Schwachstellen.
- Abhilfe: auf 2.8.6 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| bbot PyPI | ≥ 2.1.0, < 2.8.6
| 2.8.6
|
Description
The postman_download module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, allowing an attacker to write arbitrary files to the user's system.
NVD description
The postman_download module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, allowing an attacker to write arbitrary files to the user's system.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free