{"id":"CVE-2026-92205","kind":"vulnerability","aliases":["CVE-2026-92205"],"related":[],"title":"BusyBox: libarchive symlink traversal lets a file write outside the target directory","description":"BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of BusyBox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the libarchive component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of the current user. Was ZDI-CAN-27556.","summary":"BusyBox's libarchive component does not validate user-supplied paths before file operations, so a crafted archive can make BusyBox create files at locations outside the intended directory. An attacker gets arbitrary file creation in the context of the current user, and only after the victim opens a malicious file or visits a malicious page.","severity":"medium","cvss":6.1,"epss":0.00314,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["busybox","embedded","infrastructure","linux"],"not_affected_if":["no-busybox-tar-unpack"],"how_to_check":"- Run `busybox --help` on the host to confirm BusyBox is installed and read the version line\n- unknown","fix":"- unknown","status":"open","published_at":"2026-10-21T18:17:31+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:03:26+00:00","updated_at":"2026-10-25T04:03:26+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:03:26Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"BusyBox: libarchive symlink traversal lets a file write outside the target directory","impact":"medium","summary":"BusyBox's libarchive component does not validate user-supplied paths before file operations, so a crafted archive can make BusyBox create files at locations outside the intended directory. An attacker gets arbitrary file creation in the context of the current user, and only after the victim opens a malicious file or visits a malicious page.","category":"infrastructure","nicknames":[],"who_cares":["busybox","linux","embedded"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker creates arbitrary files as the current user via crafted archive","analyst_note":"Sources do not list affected or fixed BusyBox versions or whether the libarchive code path is built by default; check NVD and the BusyBox release notes for the fixed version.","how_to_check":"- Run `busybox --help` on the host to confirm BusyBox is installed and read the version line\n- unknown","needs_analyst":true,"not_affected_if":["no-busybox-tar-unpack"],"who_is_affected":"unknown","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000561,"input_tokens":3449,"output_tokens":433,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-92205':15A,18A '27556':174C 'affect':98C 'allow':90C 'arbitrari':55B,84C,95C 'archiv':40B 'attack':53B,92C,155C 'busybox':1A,19B,23B,43B,79C,101C 'compon':26B,131C 'context':60B,165C 'craft':39B 'creat':44B,94C,161C 'creation':57B,86C 'current':63B,168C 'cve':13A,16A 'directori':12A,51B,82C 'embed':20B 'exist':127C 'exploit':107C 'file':7A,35B,45B,56B,73B,85C,96C,123C,152C,162C 'flaw':126C 'get':54B 'infrastructur':21B 'instal':99C 'intend':50B 'interact':103C 'issu':133C 'lack':137C 'let':5A 'leverag':157C 'libarch':2A,25B,80C,130C 'linux':22B 'locat':47B 'make':42B 'malici':72B,77B,117C,122C 'must':114C 'open':70B,120C 'oper':36B,153C 'outsid':9A,48B 'page':78B,118C 'path':33B,146C 'prior':147C 'proper':139C 'remot':91C 'requir':105C 'result':134C 'specif':125C 'suppli':32B,145C 'symlink':3A,81C 'target':11A,113C 'travers':4A,83C 'use':149C 'user':31B,64B,102C,144C,169C 'user-suppli':30B,143C 'valid':29B,140C 'victim':69B 'visit':75B,115C 'vulner':87C,89C,109C,159C 'within':128C 'write':8A 'zdi':172C 'zdi-can':171C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T18:17:31+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92205","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92205","severity":null,"published_at":"2026-10-21T18:17:31+00:00","modified_at":"2026-10-22T17:34:37+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-92205","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92205","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}