CVE-2026-12568: Postman Download Path Traversal Flaw

CVE-2026-12568 Overview

CVE-2026-12568 is a path traversal vulnerability in the postman_download module of BBOT (Bighuge BLS OSINT Tool) from Black Lantern Security. The module constructs local directory paths by concatenating the workspace name field returned from the Postman API without sanitization. An attacker who controls a Postman workspace name can embed path traversal characters that cause pathlib to resolve outside the intended output directory. This allows arbitrary file writes to the user's filesystem when BBOT scans the malicious workspace.

Critical Impact
Arbitrary file write outside the configured output directory, enabling tampering with user-owned files and potential code execution through overwritten configuration or startup files.

Affected Products

BBOT (Bighuge BLS OSINT Tool) - postman_download module
Versions prior to commit 36bc20818
Deployments scanning untrusted Postman workspaces

Discovery Timeline

2026-06-17 - CVE-2026-12568 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-12568

Vulnerability Analysis

The save_workspace function in bbot/modules/postman_download.py builds a destination directory by joining self.output_dir with the raw workspace["name"] value from the Postman API response. Because the workspace name is attacker-controlled metadata, traversal sequences such as ../ are accepted verbatim. When passed to pathlib, the path resolves to a location outside the intended output root, and the subsequent mkdir and add_json_to_zip calls operate on the traversed location. The defect is classified as [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Root Cause

The module trusts external API data as safe filesystem input. No normalization, allow-listing, or post-resolution containment check is performed before the workspace name is used to construct on-disk paths.

Attack Vector

An attacker creates a public Postman workspace whose name contains traversal characters (for example ../../.config/malicious). A BBOT operator who runs the postman_download module against a target that surfaces this workspace triggers the write. Exploitation requires user interaction in the form of running the affected module against attacker-influenced data.

python

    def save_workspace(self, workspace, environments, collections):
        zip_path = None
        name = workspace["name"]
        id = workspace["id"]
        safe_name = self.helpers.tagify(name)
        folder = self.output_dir / safe_name
        if not folder.resolve().is_relative_to(self.output_dir.resolve()):
            self.warning(f"Workspace name {name!r} resulted in path traversal, skipping")
            return None
        self.helpers.mkdir(folder)
        zip_path = folder / f"{id}.zip"

        # Main Workspace
        self.add_json_to_zip(zip_path, workspace, f"{safe_name}.postman_workspace.json")

Source: BBOT security patch commit 36bc20818. The fix normalizes the workspace name with self.helpers.tagify() and validates that the resolved path remains inside self.output_dir before any write occurs.

Detection Methods for CVE-2026-12568

Indicators of Compromise

Files or directories created outside the configured BBOT output directory after a scan run.
BBOT log entries referencing Postman workspace names containing .., /, or \ sequences.
Unexpected .zip or .postman_workspace.json files in parent directories or user home paths.

Detection Strategies

Audit BBOT scan output directories against expected base paths, flagging any writes that escape the root.
Inspect captured Postman API responses for workspace names containing traversal metacharacters.
Review version control history of bbot/modules/postman_download.py to confirm commit 36bc20818 is present.

Monitoring Recommendations

Monitor filesystem write events from BBOT process trees and alert on writes outside the designated scan output root.
Track invocations of the postman_download module and correlate with subsequent file creation events.
Enable verbose BBOT logging to capture the workspace name warnings emitted by the patched containment check.

How to Mitigate CVE-2026-12568

Immediate Actions Required

Update BBOT to a release containing commit 36bc20818 or later.
Disable the postman_download module until the patch is applied if running scans against untrusted targets.
Run BBOT as an unprivileged user with restricted write access to sensitive directories.

Patch Information

The upstream fix is available in the Black Lantern Security BBOT repository. It introduces tagify() sanitization of the workspace name and adds a Path.resolve().is_relative_to() containment check that aborts the write when traversal is detected. See the BBOT commit 36bc20818 for the full diff.

Workarounds

Execute BBOT inside a container or sandbox with bind mounts limited to the intended output directory.
Apply mandatory access controls such as AppArmor or SELinux profiles restricting BBOT writes to the scan output path.
Pre-filter Postman API targets to exclude workspaces whose names contain .., /, or \ before invoking the module.

bash

# Update BBOT to a patched revision
pip install --upgrade bbot

# Verify the patched function contains the containment check
grep -n "is_relative_to" $(python -c "import bbot, os; print(os.path.dirname(bbot.__file__))")/modules/postman_download.py