Path Traversal Flaw in BusyBox Affects File Extraction Process
CVE-2026-124744

6.3MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 6
Red Hat Hardened Images
Vendor
CVE Published:
11 November 2026

What is CVE-2026-124744?

A flaw has been identified in BusyBox's cpio utility, where path traversal protection does not adequately sanitize hardlink target paths. This vulnerability can be exploited when a user or automated system is misled into extracting a malicious archive. Consequently, an attacker can create hardlinks pointing to files outside the intended extraction directory, enabling unauthorized modifications or overwriting of files during future extraction operations. This issue underscores the need for vigilance when handling archive files and highlights the importance of applying timely security patches to prevent exploitation.

References

https://access.redhat.com/security/cve/CVE-2026-124744
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2571625
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank ducanhluu for reporting this issue.
.