Vulnerability in BusyBox Affects Archive Extraction Functionality
CVE-2026-90954

7.8HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Hardened Images
Vendor
CVE Published:
14 October 2026

What is CVE-2026-90954?

A flaw has been identified in the archive extraction process of BusyBox's dpkg-deb, where symlinks may be mishandled during the extraction of specially crafted .deb packages. Unlike other archive handlers, BusyBox's approach flushes deferred symlinks immediately after each member of the archive is processed. An attacker can exploit this flaw by crafting a .deb archive that includes multiple data.tar members, where the first creates a symlink to an absolute path. The second member can then write an arbitrary file that traverses this symlink, compromising the intended extraction directory and potentially leading to unauthorized file creation in unexpected locations.

References

https://access.redhat.com/security/cve/CVE-2026-90954
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2533007
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue.
.