PT-2025-41396 · Bbot · Bbot

Justin Steven · Published 2025-10-09 · Updated 2025-10-10 · CVE-2025-10283

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BBOT (affected versions not specified)

Description The gitdumper module in BBOT is susceptible to exploitation, allowing attackers to execute arbitrary commands on the host system. This occurs through the processing of malicious Git repositories. The module, designed to extract data from Git repositories, does not properly sanitize the .git directory, leading to a path traversal condition and potential remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-10283

GHSA-H6M2-R6H9-4C44

Affected Products

Bbot

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-10283 · Security Note
• https://osv.dev/vulnerability/GHSA-h6m2-r6h9-4c44 · Vendor Advisory
• https://github.com/blacklanternsecurity/bbot · Note
• https://github.com/blacklanternsecurity/bbot/security/advisories/GHSA-h6m2-r6h9-4c44 · Note
• https://github.com/blacklanternsecurity/bbot/commit/0ede97fa887de33fcfd1378b4213a09c21dc6140 · Note
• https://twitter.com/0dayPublishing/status/1976319027581452480 · Twitter Post
• https://twitter.com/CveFindCom/status/1976319331504918907 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1o30vje/resumen_diario_de_vulnerabilidades_10102025 · Reddit Post
• https://twitter.com/CVEnew/status/1976328956443083029 · Twitter Post
• https://blog.blacklanternsecurity.com/p/bbot-security-advisory-gitdumper · Note
• https://twitter.com/VulmonFeeds/status/1976371781469405611 · Twitter Post
• https://twitter.com/CveTodo/status/1976323933176549500 · Twitter Post