CVE-2026-92205

Awaiting Analysis Awaiting Analysis - Queue

BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: Zero Day Initiative

Description

BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of BusyBox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the libarchive component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of the current user. Was ZDI-CAN-27556.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-92205

EUVD

EUVD-2026-107403

Affected Vendors & Products

Vendor	Product	Version / Range
BusyBox	BusyBox	1.37.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a directory traversal issue in BusyBox's libarchive component. It allows remote attackers to create arbitrary files on affected systems by exploiting improper validation of user-supplied paths before file operations. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file.

Detection Guidance

Detecting this vulnerability requires checking for BusyBox versions with the vulnerable libarchive component. Inspect installed BusyBox versions and compare them against the vendor's patched releases. Look for unusual file creation activity in system logs, especially from untrusted sources.

Impact Analysis

An attacker could create malicious files on your system in the context of your user account. This could lead to unauthorized file creation, potential system compromise, or further exploitation depending on the created files. The impact is primarily on file integrity.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized file creation on affected systems. If exploited, it may lead to unauthorized data access or modification, violating integrity and confidentiality requirements under these regulations. However, the specific compliance impact depends on system configuration and data handling practices.

Mitigation Strategies

Restrict interaction with the vulnerable BusyBox libarchive component. Avoid visiting untrusted pages or opening untrusted files to prevent exploitation.

Hi! I’m here to help you understand CVE-2026-92205. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...