Log in Start free

Vulnerability · Published Oct 21, 2026 · Assigned by zdi

CVE-2026-92205BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability

Medium 6.1

In plain English

A medium-severity path traversal in BusyBox from BusyBox. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.0)6.1Medium
Exploit odds (30 days)0.3%top 75.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of BusyBox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the libarchive component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of the current user. Was ZDI-CAN-27556.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12busyboxno fix listedDEBIAN-CVE-2026-92205
Debian:13busyboxno fix listedDEBIAN-CVE-2026-92205
Debian:14busyboxno fix listedDEBIAN-CVE-2026-92205
Ubuntu:22.04:LTSbusyboxno fix listedUBUNTU-CVE-2026-92205
Ubuntu:24.04:LTSbusyboxno fix listedUBUNTU-CVE-2026-92205
Ubuntu:26.04:LTSbusyboxno fix listedUBUNTU-CVE-2026-92205
Ubuntu:26.10busyboxno fix listedUBUNTU-CVE-2026-92205

Affected products (as reported)

VendorProductVersions
BusyBox BusyBox 1.37.0

Weakness: CWE-22 · Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

References