The unarchive module in Black Lantern Security BBOT does not validate the file paths of extracted archives, relying solely on client‑side tools such as GNU tar whose behavior varies across platforms. This omission allows a malicious archive to write files outside the intended extraction directory, potentially overwriting critical system files or placing arbitrary content, which could then be leveraged for further compromise.

Black Lantern Security BBOT is the affected product. The vulnerability manifests on systems that employ GNU tar versions older than 1.34, which includes Ubuntu 20.04, Debian Buster, CentOS 7, and numerous Docker base images. Specific BBOT version numbers are not disclosed in the advisory.

The CVSS score of 5.3 indicates a moderate risk, and the EPSS score of less than 1% suggests that exploitation is currently unlikely but not impossible. As a result, the vulnerability is not listed in the CISA KEV catalog. The exploit is primarily driven by an attacker supplying a crafted archive to the unarchive module; on vulnerable systems the archive can escape the intended directory, allowing arbitrary file creation or overwriting.