BUSYBOX · CVE-2026-124744 · Infrastructure
NO FIX YET
BusyBox's cpio extractor does not sanitize hardlink target paths even when path traversal protection is on. A crafted archive can create hardlinks pointing outside the extraction directory, letting an attacker overwrite arbitrary files on the system.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that use BusyBox's cpio applet to extract archives that may come from untrusted sources, such as embedded devices, containers and minimal Linux images. Systems that never extract untrusted cpio archives with BusyBox are unlikely to be exposed. The sources do not list affected versions.
Not affected if gnu-cpio-only, no-untrusted-cpio-extraction
Who cares busybox, containers, cpio, embedded-linux
busybox --help or busybox | head -1 to confirm BusyBox is present and read its versionbusybox cpio or the cpio applet to extract archives from untrusted sourcesNo fix yet, per the sources.
A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outside the intended extraction directory. This issue may allow an attacker to modify or overwrite arbitrary files outside the target directory during subsequent extraction operations.
This page as .md · .json · CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.