The vulnerability in BBOT 2.3.1 involves the unarchive internal module's archive extraction commands, which do not perform code-level validation of extracted file paths. Instead, they depend on external tools such as GNU tar, whose behavior varies by platform. On systems running GNU tar versions earlier than 1.34 (e.g., Ubuntu 20.04, Debian Buster, CentOS 7, and many Docker base images), a maliciously crafted archive can exploit path traversal to write files outside the intended extraction directory. Although a previous CVE (2025-10284) addressed git-specific remote code execution vectors, the underlying path traversal issue in archive extraction remains unresolved. There is no vendor advisory or patch available at this time.

This vulnerability allows an attacker to write files outside the intended extraction directory by exploiting path traversal during archive extraction. This can lead to unauthorized modification of files, potentially impacting system integrity. There is no direct confidentiality or availability impact reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid extracting untrusted archives with BBOT 2.3.1 on systems using GNU tar versions earlier than 1.34. Consider upgrading GNU tar to version 1.34 or later if possible, or use alternative extraction methods that validate file paths.