CVE-2026-12567

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12567", "assignerOrgId": "27b6da8a-f51d-48d9-9eef-9b7f3405d20d", "state": "PUBLISHED", "assignerShortName": "BLSOPS", "dateReserved": "2026-06-17T21:49:05.331Z", "datePublished": "2026-06-17T21:51:35.593Z", "dateUpdated": "2026-06-18T12:50:13.202Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "BBOT", "repo": "https://github.com/blacklanternsecurity/bbot", "vendor": "Black Lantern Security", "versions": [{"lessThanOrEqual": "<=2.8.4", "status": "affected", "version": "2.0.0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location."}], "value": "The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location."}], "impacts": [{"capecId": "CAPEC-132", "descriptions": [{"lang": "en", "value": "CAPEC-132 Symlink Attack"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.2, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-59", "description": "CWE-59 Improper Link Resolution Before File Access ('Link Following')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "27b6da8a-f51d-48d9-9eef-9b7f3405d20d", "shortName": "BLSOPS", "dateUpdated": "2026-06-17T21:51:35.593Z"}, "references": [{"url": "https://github.com/blacklanternsecurity/bbot/commit/16d9c42b6"}], "source": {"discovery": "UNKNOWN"}, "title": "Symlink-following arbitrary write via github_workflows module", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-18T12:50:06.432373Z", "id": "CVE-2026-12567", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-18T12:50:13.202Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-12567", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-18T12:50:06.432373Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-18T12:50:09.524Z"}}], "cna": {"title": "Symlink-following arbitrary write via github_workflows module", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-132", "descriptions": [{"lang": "en", "value": "CAPEC-132 Symlink Attack"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.2, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/blacklanternsecurity/bbot", "vendor": "Black Lantern Security", "product": "BBOT", "versions": [{"status": "affected", "version": "2.0.0", "versionType": "custom", "lessThanOrEqual": "<=2.8.4"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/blacklanternsecurity/bbot/commit/16d9c42b6"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location.", "supportingMedia": [{"type": "text/html", "value": "The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59 Improper Link Resolution Before File Access ('Link Following')"}]}], "providerMetadata": {"orgId": "27b6da8a-f51d-48d9-9eef-9b7f3405d20d", "shortName": "BLSOPS", "dateUpdated": "2026-06-17T21:51:35.593Z"}}}, "cveMetadata": {"cveId": "CVE-2026-12567", "state": "PUBLISHED", "dateUpdated": "2026-06-18T12:50:13.202Z", "dateReserved": "2026-06-17T21:49:05.331Z", "assignerOrgId": "27b6da8a-f51d-48d9-9eef-9b7f3405d20d", "datePublished": "2026-06-17T21:51:35.593Z", "assignerShortName": "BLSOPS"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "BBOT", "repo": "https://github.com/blacklanternsecurity/bbot", "vendor": "Black Lantern Security", "versions": [{"lessThanOrEqual": "<=2.8.4", "status": "affected", "version": "2.0.0", "versionType": "custom"}]}], "source": "cves@blacklanternsecurity.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location."}, {"lang": "es", "value": "El m\u00f3dulo github_workflows construye rutas de directorio locales a partir de nombres de repositorio controlados por el usuario sin validar en busca de enlaces simb\u00f3licos. Un atacante local que comparte el directorio de escaneo puede plantar un enlace simb\u00f3lico en la ruta de salida predecible, lo que provoca que los datos del flujo de trabajo se escriban en una ubicaci\u00f3n elegida por el atacante."}], "id": "CVE-2026-12567", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.2, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 1.4, "source": "cves@blacklanternsecurity.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12567", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-18T12:50:06.432373Z", "version": "2.0.3"}}]}, "published": "2026-06-17T23:17:03.220", "references": [{"source": "cves@blacklanternsecurity.com", "url": "https://github.com/blacklanternsecurity/bbot/commit/16d9c42b6"}], "sourceIdentifier": "cves@blacklanternsecurity.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "cves@blacklanternsecurity.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.8.4]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "BBOT", "source": "cna", "vendor": "Black Lantern Security"}, "product": "bbot", "vendor": "black_lantern_security"}], "created": "2026-06-18T18:15:02.152660+00:00", "updated": "2026-06-20T22:56:50.113439+00:00", "vendors": ["black_lantern_security", "black_lantern_security$PRODUCT$bbot"]}