{"id":"CVE-2026-12568","title":"BBOT: Arbitrary File Write in postman_download Module","summary":"BBOT: Arbitrary File Write in postman_download Module","severity":"medium","cvss":6.5,"cwe":["CWE-22","CWE-73","CWE-125"],"vendor":"bbot","product":"bbot","affected":["bbot >= 2.1.0, <= 2.8.5"],"patched":["bbot 2.8.6"],"published":"2026-06-18","updated":"2026-06-18","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-m54h-vhf9-3w3m","references":[{"url":"https://github.com/blacklanternsecurity/bbot/security/advisories/GHSA-m54h-vhf9-3w3m"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12568"},{"url":"https://github.com/blacklanternsecurity/bbot/commit/36bc20818"},{"url":"https://github.com/advisories/GHSA-m54h-vhf9-3w3m"}],"tags":["ghsa","pip"],"epss":0.00251,"epssPercentile":0.14582,"ingestedAt":"2026-06-19T03:39:00.811Z","ecosystem":"pip","slug":"CVE-2026-12568","body":"## Overview\n\nThe `postman_download` module uses the workspace `name` field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, allowing an attacker to write arbitrary files to the user's system.\n\n## Affected packages\n\n- `bbot >= 2.1.0, <= 2.8.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `bbot 2.8.6`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}