BusyBox cpio: Hardlink path traversal enables file overwrite
Summary
A flaw in the cpio archive tool of BusyBox allows hardlink target paths to escape the extraction directory when path traversal protection is enabled. If a user or automated process extracts a crafted archive, an attacker can create hardlinks to files outside the target directory and, in a later extraction, modify or overwrite those files. The attack is local, requires high complexity and depends on a user or workflow unpacking the untrusted archive.
Affected
- Red Hat Hardened Images (default: affected, according to the Red Hat CNA record)
- Red Hat Enterprise Linux 6 (default: unaffected, according to the Red Hat CNA record)
- Versions: Unknown. Third-party aggregators list 'All versions' for Red Hat Hardened Images, which is not confirmed by Red Hat.
- Relevant only if BusyBox is built with FEATURE_PATH_TRAVERSAL_PROTECTION enabled.
Fixed in
Unknown. No fixed version or Red Hat advisory has been published yet.
Workaround
- Check whether BusyBox is built with FEATURE_PATH_TRAVERSAL_PROTECTION enabled. The flaw only applies in that case.
- Until a fixed build is available, avoid extracting untrusted cpio archives with BusyBox cpio.
- If extraction is unavoidable, extract into an isolated directory as an unprivileged user and verify that no files are written outside that directory.
- Red Hat states that no mitigation is available that meets its criteria.
Exploitation
- Not known to be exploited in the wild. The CVE is not listed in CISA KEV.
- No public proof of concept found. Treat as unknown rather than absent.
- Reported to Red Hat on 25 Oct 2026 and published on 11 Nov 2026.
Our recommendation
- Check whether BusyBox cpio with path traversal protection is used in your images, firmware or appliances, especially in update, import or CI pipelines.
- Stop automatic extraction of untrusted archives with affected builds until a fix is available.
- Apply the Red Hat errata as soon as they are published and recheck when the NVD analysis appears.
- Priority: medium for hosts that handle external archives, low for typical office endpoints.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE record CVE-2026-124744 access.redhat.com
- Red Hat Bugzilla 2571625 bugzilla.redhat.com
- Microsoft Azure Linux pull request 19677 (related BusyBox backport, not confirmed as fix) github.com
- CVE-2026-124744 on threatint.com cve.threatint.com
- CVE-2026-124744 on Strix www.strix.ai
- SentinelOne CVE-2026-26158 (related BusyBox archive issue) www.sentinelone.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:30.
Original description (NVD)
A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outside the intended extraction directory. This issue may allow an attacker to modify or overwrite arbitrary files outside the target directory during subsequent extraction operations.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.