Source: busybox X-Debbugs-CC: [email protected] Severity: important Tags: security
Hi, The following vulnerability was published for busybox. CVE-2026-92205[0]: | BusyBox libarchive Symlink Directory Traversal Arbitrary File | Creation Vulnerability. This vulnerability allows remote attackers | to create arbitrary files on affected installations of BusyBox. User | interaction is required to exploit this vulnerability in that the | target must visit a malicious page or open a malicious file. The | specific flaw exists within the libarchive component. The issue | results from the lack of proper validation of a user-supplied path | prior to using it in file operations. An attacker can leverage this | vulnerability to create files in the context of the current user. | Was ZDI-CAN-27556. https://www.zerodayinitiative.com/advisories/ZDI-26-705/ If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-92205 https://www.cve.org/CVERecord?id=CVE-2026-92205 Please adjust the affected versions in the BTS as needed.
