Live › vulnerability › CVE-2025-10284
Go to dashboardBBOT's unarchive.py extracts archives from scanned web servers without checking destination paths, so a crafted archive can write files to arbitrary locations. An attacker who controls a site a user scans can use this to execute code on the scanning machine.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 15:18 UTC, 0h before NVD. All times on this page are UTC.
Anyone who runs BBOT below to scan websites they do not control can be exposed, because the flaw is triggered by the content the scanned server returns. Teams that only scan their own assets or do not run BBOT can skip it.
2.7.0| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| bbot | pypi | < 2.7.0 | 2.7.0 |
pip show bbot to read the installed version2.7.02.7.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Various issues in bbot's unarchive.py allow a malicious site to cause bbot to write arbitrary files to arbitrary locations. This can be used to achieve Remote Code Execution (RCE).
A user who uses bbot to scan a malicious webserver may have arbitrary code executed on their system.
This page as .md · .json · in your agent: get_signal("CVE-2025-10284")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.