The BBOT github_workflows module improperly limits pathname traversal, failing to resolve '..' components in paths. This allows an attacker to induce the module to write a downloaded artifact outside the configured output directory by traversing up to two directory levels above it. The target directory is determined by the operator's configuration, limiting direct attacker control over the write location. This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and affects BBOT versions from 1.1.7 through 2.8.6. The CVSS 3.1 base score is 3.1, indicating low severity, with no confidentiality or availability impact, only limited integrity impact. No official patch or remediation guidance is currently available.

The vulnerability allows limited unauthorized file writes outside the intended directory, potentially leading to integrity issues depending on the operator's configuration. There is no impact on confidentiality or availability. The attacker cannot fully control the target path, which reduces the risk severity. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, operators should carefully review and restrict the configuration of the CODE_REPOSITORY URL and output directory settings to minimize risk. Monitoring for unusual file writes outside expected directories may help detect exploitation attempts.