Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-r8f8-4pgh-4m8v

Опубликовано: 11 фев. 2026
Источник: github
Github: Не прошло ревью
CVSS3: 7

Описание

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

EPSS

Процентиль: 0%
0.00005
Низкий

7 High

CVSS3

Дефекты

CWE-73

Связанные уязвимости

CVSS3: 7
ubuntu
около 1 месяца назад

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

CVSS3: 7
redhat
около 2 месяцев назад

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

CVSS3: 7
nvd
около 1 месяца назад

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

CVSS3: 7
debian
около 1 месяца назад

A flaw was found in BusyBox. This vulnerability allows an attacker to ...

suse-cvrf
25 дней назад

Security update for busybox

EPSS

Процентиль: 0%
0.00005
Низкий

7 High

CVSS3

Дефекты

CWE-73