Filename Hiding Vulnerability in tar for BusyBox by BusyBox
CVE-2025-46394

3.2LOW

Key Information:

Vendor

Busybox

Status
Busybox
Vendor
CVE Published:
23 April 2025

What is CVE-2025-46394?

A vulnerability exists in the tar component of BusyBox up to version 1.37.0, allowing malicious actors to obscure filenames within TAR archives using terminal escape sequences. This deceptive practice can hinder users from accurately assessing the contents of an archive, raising significant security concerns regarding file integrity and transparency. Users and administrators should take appropriate measures to mitigate this risk, especially those relying on BusyBox for handling TAR files.

Affected Version(s)

BusyBox 0 <= 1.37.0

References

https://bugs.busybox.net/show_bug.cgi?id=16018
https://www.busybox.net/downloads/
https://www.busybox.net

CVSS V3.1

Score:
3.2
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.