by Kastro
Paper/Archive/CVE-2025-10284

CVE-2025-10284

BLSOPS, LLC bbot — Improper Archive Extraction in unarchive Enables RCE

EPSS 0.7%CVSS 9.6
critical.is priorityof 100
40
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 53.6.536 × 2010.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

BBOT's unarchive module could be abused by supplying malicious archives files and when extracted can then perform an arbitrary file write, resulting in remote code execution.

Affected

ProductAffectedFixed inSource
bbot0.0.0 – 2.6.1–CNA

Scores by source

BLSOPS (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refblog.blacklanternsecurity.com/p/bbot-security-advisory-gitdumper