All vulnerabilities
CVE-2025-10284GHSA-fhw8-8v9p-7jp7PYSEC-2026-292

BBOT's various issues in unarchive.py can cause arbitrary file write and RCE

BLSOPS, LLC bbotpipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.6Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.71%Chance of exploitation activity in the next 30 days, higher than 53% of CVEs. Scored 27 Oct 2026FIRST EPSS
Fixed in2.7.0Fixed versionGitHub
Published9 Oct 2025Updated 27 Oct 2026CVE List

What fixes it

  • 2.7.0bbot, pipGitHub
  • 2.7.0bbot, PyPIOSVpip install "bbot>=2.7.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

Various issues in bbot's unarchive.py allow a malicious site to cause bbot to write arbitrary files to arbitrary locations. This can be used to achieve Remote Code Execution (RCE).

Impact

A user who uses bbot to scan a malicious webserver may have arbitrary code executed on their system.

Text from GitHub Advisory Database

Affected versions 53

  • bbot, pip< 2.7.0GitHub
  • bbotaffected: 0.0.0 through 2.6.1CVE List
  • bbot, PyPIfrom first release, fixed in 2.7.0OSV
  • bbot, PyPI1.0.0OSV
  • bbot, PyPI1.0.1OSV
  • bbot, PyPI1.0.2OSV
  • bbot, PyPI1.0.3OSV
  • bbot, PyPI1.0.3.512OSV
  • bbot, PyPI1.0.3.521OSV
  • bbot, PyPI1.0.3.545OSV
  • bbot, PyPI1.0.3.583OSV
  • bbot, PyPI1.0.3.696OSV
  • bbot, PyPI1.0.3.777OSV
  • bbot, PyPI1.0.3.780OSV
  • bbot, PyPI1.0.3.919OSV
  • bbot, PyPI1.0.4.1132rc0OSV
  • bbot, PyPI1.0.4.1134rc0OSV
  • bbot, PyPI1.0.4.1139rc0OSV
  • bbot, PyPI1.0.4.1141rc0OSV
  • bbot, PyPI1.0.4.1147rc0OSV
  • bbot, PyPI1.0.4.1156rc0OSV
  • bbot, PyPI1.0.4.1158rc0OSV
  • bbot, PyPI1.0.4.1160rc0OSV
  • bbot, PyPI1.0.4.1162rc0OSV
  • bbot, PyPI1.0.4.1164rc0OSV
  • bbot, PyPI1.0.4.1166rc0OSV
  • bbot, PyPI1.0.4.1168rc0OSV
  • bbot, PyPI1.0.4.1170rc0OSV
  • bbot, PyPI1.0.4.1173rc0OSV
  • bbot, PyPI1.0.4.1175rc0OSV
  • bbot, PyPI1.0.4.1177rc0OSV
  • bbot, PyPI1.0.4.1183rc0OSV
  • bbot, PyPI1.0.4.1185rc0OSV
  • bbot, PyPI1.0.4.1193rc0OSV
  • bbot, PyPI1.0.4.1197rc0OSV
  • bbot, PyPI1.0.4.1199rc0OSV
  • bbot, PyPI1.0.4.1233rc0OSV
  • bbot, PyPI1.0.4.1235rc0OSV
  • bbot, PyPI1.0.4.1237rc0OSV
  • bbot, PyPI1.0.4.1242rc0OSV
  • bbot, PyPI1.0.4.1262rc0OSV
  • bbot, PyPI1.0.4.1266rc0OSV
  • bbot, PyPI1.0.4.1269rc0OSV
  • bbot, PyPI1.0.4.1272rc0OSV
  • bbot, PyPI1.0.4.1276rc0OSV
  • bbot, PyPI1.0.4.1279rc0OSV
  • bbot, PyPI1.0.4.1285rc0OSV
  • bbot, PyPI1.0.4.1303rc0OSV
  • bbot, PyPI1.0.4.1306rc0OSV
  • bbot, PyPI1.0.4.1310rc0OSV
  • bbot, PyPI1.0.4.922OSV
  • bbot, PyPI1.0.5.1313rc0OSV
  • bbot, PyPI1.0.5.1317rc0OSV

References 7