Vulnerability PYSEC-2026-2393
Medium Risk
MEDIUM RISK
CVSS Score: 6.5
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
3 months ago
July 13, 2026 at 03:46 PM UTC
BBOT: Arbitrary File Write in postman_download Module
2.1.0 - 2.8.5
2.1.0 - 2.8.5
Summary
BBOT: Arbitrary File Write in postman_download Module
Details
The postman_download module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, allowing an attacker to write arbitrary files to the user's system.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
10 hours ago
BBOT's Symlink guard bypass in unarchive module allows planting symlinks during extraction
2.3.1 - 2.8.6 GHSA-xpf3-p7gm-7756
2.3.1 - 2.8.6 GHSA-xpf3-p7gm-7756
Low Risk
3 months ago
BBOT: Server-Side Request Forgery (SSRF) in docker_pull module via WWW-Authenticate realm parsing
2.0.0 - 2.8.4.7578rc0 PYSEC-2026-2391
2.0.0 - 2.8.4.7578rc0 PYSEC-2026-2391
Medium Risk
3 months ago
BBOT: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-10284
2.3.1 - 2.8.4.7578rc0 PYSEC-2026-2392
2.3.1 - 2.8.4.7578rc0 PYSEC-2026-2392
Low Risk
3 months ago
BBOT: Symlink-Following Arbitrary Write via github_workflows Module
2.0.0 - 2.8.4.7578rc0 PYSEC-2026-2394
2.0.0 - 2.8.4.7578rc0 PYSEC-2026-2394
Low Risk
3 months ago
No summary available
2.3.1 - 2.8.6 PYSEC-2026-3719
2.3.1 - 2.8.6 PYSEC-2026-3719
Impacted packages
Timeline
Published
3 months ago
July 13, 2026 at 03:46 PM UTC
Fixed (2.8.6)
3 months ago
June 17, 2026 at 12:03 PM UTC
Last Modified
3 months ago
July 13, 2026 at 04:31 PM UTC