CVE-2026-90954

Awaiting Analysis Awaiting Analysis - Queue

Path Traversal in BusyBox dpkg-deb Archive Extraction

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: redhat-SADP

Description

A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this ordering: the first member declares a symlink pointing to an absolute path (e.g., '/'), which is deferred as unsafe but flushed after the first member. The second member declares a regular file whose path traverses the now-live symlink, resulting in a file being written outside the intended extraction directory. This could allow an attacker to write arbitrary files to arbitrary locations when a user extracts a crafted .deb package.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-90954

EUVD

EUVD-2026-100951

Affected Vendors & Products

Vendor	Product	Version / Range
Red	Hat	Red Hat Hardened Images *

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

CVE-2026-90954 is a path traversal vulnerability in BusyBox's dpkg-deb tool. It occurs because the ar archive handler flushes deferred symlinks after each archive member instead of after all members. This allows a crafted .deb file with two data.tar members to write files outside the intended directory. The first member creates a symlink to an absolute path like '/', which becomes active after the first member. The second member then writes a file through this symlink to an arbitrary location.

Detection Guidance

To detect this vulnerability, inspect .deb files for multiple uncompressed data.tar members using commands like 'ar t <package.deb>' to list archive members and 'tar -tvf data.tar' to check for symlinks or suspicious paths. Monitor for unexpected file writes outside extraction directories during dpkg-deb operations.

Impact Analysis

This vulnerability could allow an attacker to write arbitrary files to any location on your system when you extract a specially crafted .deb package. This might lead to system compromise, data corruption, or installation of malicious software. The impact is high as it affects confidentiality, integrity, and availability of the system.

Compliance Impact

This vulnerability could potentially violate compliance with standards like GDPR and HIPAA by allowing unauthorized file writes outside intended directories. If exploited, it may enable attackers to place malicious files in sensitive system locations, compromising data integrity and confidentiality. This could lead to unauthorized access to personal or protected health information, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information.

Mitigation Strategies

Avoid using BusyBox's dpkg-deb for untrusted .deb files. Use Debian's dpkg-deb instead. Inspect archives for multiple data.tar members before extraction. If BusyBox dpkg-deb is required, ensure it runs in a restricted environment to limit file system access.

Hi! I’m here to help you understand CVE-2026-90954. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70