CVE-2026-12567: GitHub Workflows Path Traversal Vulnerability

CVE-2026-12567 Overview

CVE-2026-12567 is a symlink-following vulnerability in the github_workflows module of BBot, an open-source recon framework from Black Lantern Security. The module builds local output directory paths from user-controlled repository names without validating whether intermediate path components are symbolic links. A local attacker who shares the scan directory can pre-create a symlink at the predictable output location, redirecting workflow data to an attacker-chosen file system location. The flaw is tracked as a symlink attack under CWE-59.

Critical Impact
A local user with access to the BBot scan output directory can redirect workflow log writes to arbitrary file system paths, leading to integrity loss of files writable by the BBot process.

Affected Products

Black Lantern Security BBot — github_workflows module (versions prior to commit 16d9c42b6)

Discovery Timeline

2026-06-17 - CVE-2026-12567 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-12567

Vulnerability Analysis

The github_workflows module downloads GitHub Actions run logs and writes them to a local folder derived from the owner and repository names returned by the GitHub API. The destination path is constructed as self.output_dir / owner / repo and passed directly to mkdir without verifying that any component along the path is a regular directory. When the path traverses a symlink planted by another local user, file operations follow the link to the attacker-controlled target.

Exploitation requires local access to the scan output directory, user interaction to launch a BBot scan that enumerates the targeted repository, and a race against directory creation. The impact is limited to integrity of files writable by the BBot process — there is no confidentiality loss and no availability impact in the base scoring.

Root Cause

The download routine combined trusted output roots with untrusted path segments and called mkdir without first walking the path to reject symbolic links. Because the owner and repository names come from network-sourced scan results, an attacker who can predict the scan target can stage a symlink before BBot creates the directory tree.

Attack Vector

A local attacker creates a symlink at <output_dir>/<owner>/<repo> pointing to a directory the BBot process can write to. When BBot processes the target repository's workflow runs, it writes run_<id>.zip files through the symlink into the attacker-chosen location, potentially overwriting existing files.

python

             runs.append(item)
         return runs
 
+    def _check_output_path(self, folder):
+        try:
+            rel = folder.relative_to(self.output_dir)
+        except ValueError:
+            return False
+        current = self.output_dir
+        for part in rel.parts:
+            current = current / part
+            if current.is_symlink():
+                self.warning(f"Refusing to write through symlink: {current}")
+                return False
+        return True
+
     async def download_run_logs(self, owner, repo, run_id):
         folder = self.output_dir / owner / repo
+        if not self._check_output_path(folder):
+            return []
         self.helpers.mkdir(folder)
         filename = f"run_{run_id}.zip"
         file_destination = folder / filename

Source: BBot security patch commit 16d9c42b6

The patch adds _check_output_path, which walks each component of the relative path beneath output_dir and refuses to proceed if any element is a symbolic link.

Detection Methods for CVE-2026-12567

Indicators of Compromise

Symbolic links present under the BBot scan output directory pointing outside the expected scan tree.
BBot log entries containing Refusing to write through symlink: after patching, indicating an attempted exploitation event.
Unexpected files named run_<id>.zip appearing in directories that BBot does not normally write to.

Detection Strategies

Audit the BBot output_dir before each scan for symlinks using find <output_dir> -type l.
Enable file integrity monitoring on directories writable by the BBot process to flag writes that occur via symbolic links.
Review BBot module warnings for the patched refusal message to identify attempted symlink redirection.

Monitoring Recommendations

Log and alert on creation of symlinks in shared scan directories on multi-user hosts.
Track BBot process file writes with auditd or eBPF tracing to confirm writes resolve within the intended output tree.
Restrict the github_workflows module to dedicated, single-user scan hosts and monitor for deviations from that baseline.

How to Mitigate CVE-2026-12567

Immediate Actions Required

Update BBot to a build that includes commit 16d9c42b6 or later, which adds the symlink check in github_workflows.
Run BBot scans in directories owned exclusively by the scanning user with mode 0700 to prevent other local users from planting symlinks.
Inspect existing scan output directories for unexpected symbolic links and remove any that are not authorized.

Patch Information

The fix is applied in BBot commit 16d9c42b6. The patch introduces _check_output_path in bbot/modules/github_workflows.py, which validates each path component beneath output_dir and rejects writes that would traverse a symbolic link.

Workarounds

Disable the github_workflows module until the patch is applied by excluding it from scan configurations.
Run BBot inside a container or dedicated user account so that no other local principal can write to the scan output directory.
Pre-create the expected <output_dir>/<owner>/<repo> directories as real directories owned by the BBot user before each scan.

bash

# Configuration example: lock down the scan output directory
install -d -m 0700 -o bbot -g bbot /var/lib/bbot/scans
find /var/lib/bbot/scans -type l -print -delete
pip install --upgrade bbot