External risk intelligence

BBOT Unarchive Module Arbitrary File Write Leading to Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2025-10284

BBOT is a security scanning and reconnaissance framework, not a public-facing service. Its modules, such as the unarchive module, are typically executed by users in isolated or controlled environments during security assessments. It is not designed to be an internet-facing service or appliance.

Path Traversal

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in a security tool's unarchive module that could allow an attacker to execute arbitrary code by providing a specially crafted archive file, potentially leading to significant compromise if exploited. The main concern is to confirm if this specific tool is in use and, if so, to understand its exposure.

Malicious archives enable code execution.
Tool usage dictates leadership relevance.
Confirm tool use; assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by tricking a user into extracting a specially crafted archive file. When the archive is processed by the unarchive module, it can write files to arbitrary locations on the system. This capability, if leveraged correctly, could lead to the execution of malicious code on the targeted machine.

Malicious archive file needed.
User must extract the archive.
Arbitrary file write allows code execution.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability in BBOT's unarchive module could allow an attacker to execute arbitrary code on a system by providing specially crafted archive files. When these malicious archives are extracted, they can lead to an arbitrary file write, potentially enabling remote code execution under specific conditions where the module is utilized.

System files could be overwritten.
Malicious archive files could be extracted.
Arbitrary code execution could occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in BBOT's unarchive module could allow remote code execution if a user is tricked into extracting a malicious archive. The first step for security teams is to determine if BBOT is deployed in their environment, whether it is accessible by an authenticated user who could be targeted, and then to identify the system owner responsible for the tool or the user account that runs it to plan remediation.

Identify accountable system owners.
Verify user exposure to malicious archives.
Plan remediation or temporary risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is BBOT and how is it used?

BBOT is a specialized security framework designed for reconnaissance and scanning tasks. Security professionals use it to automate the collection of data during assessments, typically running its modules in isolated or controlled local environments rather than as a persistent public service.

How does CVE-2025-10284 create a security risk?

This vulnerability is classified as Improper Limitation of a Pathname to a Restricted Directory, or CWE-22. It occurs because the unarchive module does not properly validate file paths within archives, allowing a specially crafted file to be written outside of the intended directory, which can eventually lead to unauthorized code execution.

What does an attacker need to do to trigger this bug?

An attacker must successfully trick a user into processing a malicious archive file using the vulnerable module. The vulnerability is not triggered simply by the presence of the software; it requires the specific action of extracting a compromised archive provided by an external source.

Is my environment at risk from this vulnerability?

Halo Surface Signal indicates that because BBOT is a security framework rather than a public-facing service or appliance, it is very unlikely to be exposed to the open internet. Risk is generally limited to environments where users intentionally process untrusted or external archive files during security operations.

How should I respond if I use BBOT?

Start by identifying where BBOT is installed and determining which team members or service accounts actively run the unarchive module. Verify whether those users handle external data, identify the system owners responsible for those environments, and prepare to update or restrict usage until the module is patched.

References

blog.blacklanternsecurity.com/p/bbot-security-advisory-gitdumper

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.