CVE-2026-12568

CVSS Score & Metrics

Base Score

6.5 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N                                    

Vulnerability Description

The postman_download module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, allowing an attacker to write arbitrary files to the user's system.

Vulnerability Details

Published Date

June 17, 2026

Last Modified

June 18, 2026

CWE ID

CWE-22

Source

NVD

Vendor

Black Lantern Security

Product

BBOT

External References

https://github.com/blacklanternsecurity/bbot/commit/36bc20818

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment