{"id":"CVE-2026-124745","kind":"vulnerability","aliases":["CVE-2026-124745"],"related":[],"title":"BusyBox tar: crafted archive can overwrite files outside extraction directory","description":"A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links pointing outside the intended extraction directory. An attacker could provide a specially crafted archive that links to sensitive files outside the extraction tree, allowing subsequent extraction operations to overwrite arbitrary files on the system.","summary":"BusyBox tar mishandles deferred hardlink targets that pass through symbolic links pointing outside the extraction directory. A specially crafted archive can make later extraction overwrite arbitrary files on the system.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["busybox","containers","embedded","infrastructure","linux"],"not_affected_if":["no-untrusted-archives"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-11T13:17:20+00:00","first_seen_at":"2026-11-11T13:27:13+00:00","triaged_at":"2026-11-11T13:29:21+00:00","updated_at":"2026-11-11T13:29:21+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-11T13:29:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"BusyBox tar: crafted archive can overwrite files outside extraction directory","impact":"medium","summary":"BusyBox tar mishandles deferred hardlink targets that pass through symbolic links pointing outside the extraction directory. A specially crafted archive can make later extraction overwrite arbitrary files on the system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["busybox","embedded","containers","linux"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"arbitrary files overwritten on the extracting system","analyst_note":"Check the NVD entry and BusyBox upstream for affected and fixed versions and whether the flaw needs a user to extract an archive.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-archives"],"who_is_affected":"Systems that run BusyBox tar to extract archives from untrusted sources, such as container images, embedded devices or upload handlers, are the ones to look at. Systems that never extract untrusted archives with BusyBox tar can skip it. The sources do not list affected BusyBox versions.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000687,"input_tokens":4548,"output_tokens":465,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124745':13A,16A '-2026':12A,15A 'across':70C 'allow':96C 'arbitrari':47B,102C 'archiv':4A,41B,61C,86C 'attack':80C 'busybox':1A,17B,22B,57C 'contain':18B 'could':81C 'craft':3A,40B,85C 'cve':11A,14A 'defer':25B,67C 'directori':10A,37B,78C 'embed':19B 'extract':9A,36B,45B,59C,77C,94C,98C 'file':7A,48B,91C,103C 'flaw':53C 'found':55C 'hardlink':26B,68C 'improp':65C 'infrastructur':20B 'intend':76C 'later':44B 'link':32B,72C,88C 'linux':21B 'make':43B 'mishandl':24B 'oper':99C 'outsid':8A,34B,74C,92C 'overwrit':6A,46B,101C 'pass':29B 'point':33B,73C 'provid':82C 'resolv':66C 'sensit':90C 'special':39B,84C 'subsequ':97C 'symbol':31B,71C 'system':51B,106C 'tar':2A,23B,63C 'target':27B,69C 'tree':95C 'util':64C","nicknames":[],"mitigations":[],"who_affected":"Systems that run BusyBox tar to extract archives from untrusted sources, such as container images, embedded devices or upload handlers, are the ones to look at. Systems that never extract untrusted archives with BusyBox tar can skip it. The sources do not list affected BusyBox versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["busybox","containers","embedded","infrastructure","linux","medium"],"campaign_type":null,"search_a":"'-124745':13A,16A '-2026':12A,15A 'archiv':4A 'busybox':1A 'craft':3A 'cve':11A,14A 'directori':10A 'extract':9A 'file':7A 'outsid':8A 'overwrit':6A 'tar':2A","search_b":"'arbitrari':47B 'archiv':41B 'busybox':17B,22B 'contain':18B 'craft':40B 'defer':25B 'directori':37B 'embed':19B 'extract':36B,45B 'file':48B 'hardlink':26B 'infrastructur':20B 'later':44B 'link':32B 'linux':21B 'make':43B 'mishandl':24B 'outsid':34B 'overwrit':46B 'pass':29B 'point':33B 'special':39B 'symbol':31B 'system':51B 'tar':23B 'target':27B","search_c":"'across':70C 'allow':96C 'arbitrari':102C 'archiv':61C,86C 'attack':80C 'busybox':57C 'could':81C 'craft':85C 'defer':67C 'directori':78C 'extract':59C,77C,94C,98C 'file':91C,103C 'flaw':53C 'found':55C 'hardlink':68C 'improp':65C 'intend':76C 'link':72C,88C 'oper':99C 'outsid':74C,92C 'overwrit':101C 'point':73C 'provid':82C 'resolv':66C 'sensit':90C 'special':84C 'subsequ':97C 'symbol':71C 'system':106C 'tar':63C 'target':69C 'tree':95C 'util':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124745","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124745","severity":null,"published_at":"2026-11-11T13:17:20+00:00","modified_at":"2026-11-11T13:17:20+00:00","first_seen_at":"2026-11-11T13:27:13+00:00","fetched_at":"2026-11-11T13:27:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}