Hi, I propose a lightweight downstream patch to fix CVE-2026-7179 in binwalk 2.4.3 (Bug #1136010). The change is isolated to `src/binwalk/plugins/winceextract.py` and uses `os.path.realpath()` + `os.path.commonpath()` to ensure extracted filenames cannot escape the intended extraction directory; traversal attempts are logged and skipped. This preserves legitimate nested extractions and avoids a naive `basename()` rewrite.
I would be happy if someone could sponsor to land this patch in unstable (debian/patches) to protect users, while I work in parallel on packaging the maintained Rust rewrite (binwalk3) as a longer‑term replacement. Best regards, Fukui -- Fukui Daichi GPG key: 4096R/9EF66C2D2315BB7C
Description: Prevent path traversal in WinCE extraction plugin The WinCE extraction plugin trusted filenames supplied by the input image and used them directly to construct output paths. A crafted WinCE image could therefore cause files to be written outside the extraction directory. . Resolve the extraction paths and ensure they remain below the extraction directory before writing files. . CVE-2026-7179 Bug-Debian: https://bugs.debian.org/1136010 Forwarded: not-needed Author: Fukui Daichi <[email protected]> --- a/src/binwalk/plugins/winceextract.py +++ b/src/binwalk/plugins/winceextract.py @@ -1,4 +1,5 @@ import binwalk.core.plugin +from binwalk.core.common import warning import re import os @@ -38,1 +38,11 @@ - def extractor(self, fname): + def _safe_output_path(self, indir, filename): + indir = os.path.realpath(indir) + output_path = os.path.realpath(os.path.join(indir, filename)) + + if os.path.commonpath([indir, output_path]) != indir: + warning("Path traversal blocked: %s" % filename) + return None + + return output_path + + def extractor(self, fname): @@ -52,8 +62,14 @@ with open(infile, 'r+b') as f: with WinCEExtractor(f, 0) as extractor: for module in extractor.modules: - with open(os.path.join(indir, module.file_name), 'w+b') as module_file: + output_path = self._safe_output_path(indir, module.file_name) + if output_path is None: + continue + with open(output_path, 'w+b') as module_file: module.write_to(module_file) for file_e in extractor.files: - with open(os.path.join(indir, file_e.file_name), 'w+b') as file_file: + output_path = self._safe_output_path(indir, file_e.file_name) + if output_path is None: + continue + with open(output_path, 'w+b') as file_file: file_e.write_to(file_file)
signature.asc
Description: PGP signature
