---
id: "CVE-2026-124744"
page: "https://infrastack.ai/live/CVE-2026-124744"
kind: "vulnerability"
aliases: ["CVE-2026-124744"]
title: "BusyBox cpio: hardlink paths escape extraction directory, overwriting files"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "busybox", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["busybox", "containers", "cpio", "embedded-linux", "infrastructure"]
not_affected_if: ["gnu-cpio-only", "no-untrusted-cpio-extraction"]
published_at: "2026-11-11T13:17:19+00:00"
first_seen_at: "2026-11-11T13:27:13+00:00"
updated_at: "2026-11-11T13:29:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124744", "first_seen_at": "2026-11-11T13:27:13+00:00"}]
exploit_sources: []
---

# BusyBox cpio: hardlink paths escape extraction directory, overwriting files

Link for people: https://infrastack.ai/live/CVE-2026-124744 (this .md is for agents)

BusyBox's cpio extractor does not sanitize hardlink target paths even when path traversal protection is on. A crafted archive can create hardlinks pointing outside the extraction directory, letting an attacker overwrite arbitrary files on the system.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:busybox affected range not listed fixed no fixed version listed

## How to check

- `busybox --help` or `busybox | head -1` to confirm BusyBox is present and read its version
- Check whether any scripts or services run `busybox cpio` or the cpio applet to extract archives from untrusted sources

## Timeline

- 2026-11-11T13:27:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124744

## From the sources

A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outside the intended extraction directory. This issue may allow an attacker to modify or overwrite arbitrary files outside the target directory during subsequent extraction operations.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_