{"id":"CVE-2026-124744","kind":"vulnerability","aliases":["CVE-2026-124744"],"related":[],"title":"BusyBox cpio: hardlink paths escape extraction directory, overwriting files","description":"A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outside the intended extraction directory. This issue may allow an attacker to modify or overwrite arbitrary files outside the target directory during subsequent extraction operations.","summary":"BusyBox's cpio extractor does not sanitize hardlink target paths even when path traversal protection is on. A crafted archive can create hardlinks pointing outside the extraction directory, letting an attacker overwrite arbitrary files on the system.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"busybox","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["busybox","containers","cpio","embedded-linux","infrastructure"],"not_affected_if":["gnu-cpio-only","no-untrusted-cpio-extraction"],"how_to_check":"- `busybox --help` or `busybox | head -1` to confirm BusyBox is present and read its version\n- Check whether any scripts or services run `busybox cpio` or the cpio applet to extract archives from untrusted sources","fix":null,"status":"open","published_at":"2026-11-11T13:17:19+00:00","first_seen_at":"2026-11-11T13:27:13+00:00","triaged_at":"2026-11-11T13:29:24+00:00","updated_at":"2026-11-11T13:29:24+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-11T13:29:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"BusyBox cpio: hardlink paths escape extraction directory, overwriting files","impact":"medium","summary":"BusyBox's cpio extractor does not sanitize hardlink target paths even when path traversal protection is on. A crafted archive can create hardlinks pointing outside the extraction directory, letting an attacker overwrite arbitrary files on the system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["busybox","cpio","embedded-linux","containers"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker overwrites arbitrary files outside the extraction directory","analyst_note":"Find the affected and fixed BusyBox versions and the upstream commit from the NVD entry or the BusyBox project, since the sources give none.","how_to_check":"- `busybox --help` or `busybox | head -1` to confirm BusyBox is present and read its version\n- Check whether any scripts or services run `busybox cpio` or the cpio applet to extract archives from untrusted sources\n- unknown for the exact affected version range, since the sources do not list it","plain_action":"","product_name":"busybox","needs_analyst":true,"not_affected_if":["no-untrusted-cpio-extraction","gnu-cpio-only"],"who_is_affected":"Systems that use BusyBox's cpio applet to extract archives that may come from untrusted sources, such as embedded devices, containers and minimal Linux images. Systems that never extract untrusted cpio archives with BusyBox are unlikely to be exposed. The sources do not list affected versions.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000769,"input_tokens":4568,"output_tokens":624,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124744':12A,15A '-2026':11A,14A 'allow':115C 'arbitrari':56B,122C 'archiv':43B,97C 'attack':54B,99C,117C 'autom':91C 'busybox':1A,16A,17B,24B,66C 'contain':18B 'cpio':2A,19B,26B,72C 'craft':42B,96C 'creat':45B,101C 'cve':10A,13A 'directori':7A,51B,111C,127C 'embed':21B 'embedded-linux':20B 'enabl':78C 'escap':5A 'even':34B 'extract':6A,50B,68C,94C,110C,130C 'extractor':27B 'file':9A,57B,69C,106C,123C 'flaw':62C 'found':64C 'hardlink':3A,31B,46B,79C,102C 'infrastructur':23B 'intend':109C 'issu':113C 'let':52B 'linux':22B 'may':114C 'modifi':119C 'oper':131C 'outsid':48B,107C,124C 'overwrit':8A,55B,121C 'path':4A,33B,36B,75C,81C 'point':47B,104C 'process':92C 'proper':84C 'protect':38B,77C 'sanit':30B,85C 'subsequ':129C 'system':60B 'target':32B,80C,126C 'travers':37B,76C 'trick':87C 'use':70C 'user':89C 'util':73C","nicknames":[],"mitigations":[],"who_affected":"Systems that use BusyBox's cpio applet to extract archives that may come from untrusted sources, such as embedded devices, containers and minimal Linux images. Systems that never extract untrusted cpio archives with BusyBox are unlikely to be exposed. The sources do not list affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["busybox"],"ptokens":["busybox"],"labels":["busybox","containers","cpio","embeddedlinux","infrastructure","medium","vendor"],"campaign_type":null,"search_a":"'-124744':12A,15A '-2026':11A,14A 'busybox':1A,16A 'cpio':2A 'cve':10A,13A 'directori':7A 'escap':5A 'extract':6A 'file':9A 'hardlink':3A 'overwrit':8A 'path':4A","search_b":"'arbitrari':56B 'archiv':43B 'attack':54B 'busybox':17B,24B 'contain':18B 'cpio':19B,26B 'craft':42B 'creat':45B 'directori':51B 'embed':21B 'embedded-linux':20B 'even':34B 'extract':50B 'extractor':27B 'file':57B 'hardlink':31B,46B 'infrastructur':23B 'let':52B 'linux':22B 'outsid':48B 'overwrit':55B 'path':33B,36B 'point':47B 'protect':38B 'sanit':30B 'system':60B 'target':32B 'travers':37B","search_c":"'allow':115C 'arbitrari':122C 'archiv':97C 'attack':99C,117C 'autom':91C 'busybox':66C 'cpio':72C 'craft':96C 'creat':101C 'directori':111C,127C 'enabl':78C 'extract':68C,94C,110C,130C 'file':69C,106C,123C 'flaw':62C 'found':64C 'hardlink':79C,102C 'intend':109C 'issu':113C 'may':114C 'modifi':119C 'oper':131C 'outsid':107C,124C 'overwrit':121C 'path':75C,81C 'point':104C 'process':92C 'proper':84C 'protect':77C 'sanit':85C 'subsequ':129C 'target':80C,126C 'travers':76C 'trick':87C 'use':70C 'user':89C 'util':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124744","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124744","severity":null,"published_at":"2026-11-11T13:17:19+00:00","modified_at":"2026-11-11T13:17:20+00:00","first_seen_at":"2026-11-11T13:27:13+00:00","fetched_at":"2026-11-11T13:27:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}