The postman_download module builds the local output directory from the workspace name returned by the Postman API. Because the name is used without any sanitization, a malicious workspace can contain path‑traversal characters. When pathlib resolves the path, it can point outside the intended directory, allowing the tool to create or overwrite files wherever it has write permission. This flaw permits an attacker who can create or modify a workspace to write arbitrary files to the system that runs BBOT, potentially compromising confidentiality, integrity, and availability of the affected machine.

Black Lantern Security BBOT. No specific version information is provided, so any install that uses the postman_download module without input validation may be affected.

The CVSS score of 6.5 indicates medium severity, while the EPSS score of less than 1% shows a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker who controls a Postman workspace sent to the vulnerable BBOT instance; the victim must run the tool against that workspace. Attackers with API access to a user’s Postman account are the most likely perpetrators, and the impact rises sharply if the vulnerable process runs with elevated privileges or on a shared filesystem.