The vulnerability arises because the postman_download module in BBOT 2.1.0 uses the workspace name field from the Postman API to build local directory paths without proper sanitization. Pathlib resolves these paths, and if the workspace name includes path traversal sequences (e.g., '../'), the resolved path can escape the intended output directory. This improper limitation of pathname to a restricted directory (CWE-22) enables an attacker to write arbitrary files to the user's system, potentially impacting integrity. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker can cause arbitrary file writes on the user's system by exploiting the path traversal vulnerability in BBOT 2.1.0. This compromises the integrity of the system by allowing unauthorized modification or creation of files outside the intended directory. There is no direct impact on confidentiality or availability according to the CVSS vector. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid processing untrusted or malicious workspace names with the postman_download module. Implementing manual sanitization or validation of workspace names to prevent path traversal characters may reduce risk.