Cloudanix VulnDB

CVE-2026-92205

Medium · 6.1

CVSS

6.1

EPSS

0.3%

Published

Oct 21, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in BusyBox can let someone who tricks you into opening a specially made file place other files anywhere on your computer without permission.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Data Tampering
Component
Library
Class
Path Traversal
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw permits creation of arbitrary files via insufficient validation of user-supplied paths containing symlinks during archive extraction in the libarchive component, allowing files to be written outside intended directories in the context of the current user.

Why it matters to the business

Attackers can place malicious files on systems processing untrusted archives, potentially enabling persistence, configuration tampering, or follow-on code execution that disrupts operations or compromises data integrity.

How an attack unfolds

An attacker crafts a malicious archive containing symlinks that point outside the extraction target directory. When the victim opens the archive with an affected BusyBox utility, the path traversal writes attacker-controlled files to arbitrary locations on the filesystem.

How to fix it

Update BusyBox to a version containing the libarchive fix once released. Until then, avoid opening untrusted archives with BusyBox utilities and prefer alternative archive tools with stricter path validation.

How to confirm the fix worked

Confirm BusyBox and its libarchive component are upgraded to the patched release; test by attempting extraction of a crafted archive containing symlinks and verify files are not created outside the target directory.

Typical attack path

  1. Craft malicious archive with symlink entries
  2. Deliver archive via web page, email attachment, or shared file
  3. Victim opens archive using BusyBox libarchive-based tool
  4. Files written to attacker-chosen paths on victim system
  5. Attacker leverages planted files for further access or execution

How to detect it

Review system logs and file creation events around the time untrusted archives were processed; look for unexpected files appearing in system directories or paths outside normal extraction targets.

What your security team should do

  • Prioritize patching BusyBox in all environments handling untrusted archives
  • Restrict use of BusyBox archive utilities to trusted inputs only
  • Monitor for new BusyBox releases addressing this libarchive issue
  • Implement application allow-listing to limit archive extraction tools

The record

BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of BusyBox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the libarchive component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of the current user. Was ZDI-CAN-27556.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities