CVE-2026-124745 · Infrastructure
NO FIX YET
BusyBox tar mishandles deferred hardlink targets that pass through symbolic links pointing outside the extraction directory. A specially crafted archive can make later extraction overwrite arbitrary files on the system.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run BusyBox tar to extract archives from untrusted sources, such as container images, embedded devices or upload handlers, are the ones to look at. Systems that never extract untrusted archives with BusyBox tar can skip it. The sources do not list affected BusyBox versions.
Not affected if no-untrusted-archives
Who cares busybox, containers, embedded, linux
Unknown from the sources.
No fix yet, per the sources.
A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links pointing outside the intended extraction directory. An attacker could provide a specially crafted archive that links to sensitive files outside the extraction tree, allowing subsequent extraction operations to overwrite arbitrary files on the system.
This page as .md · .json · CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.