BusyBox dpkg-deb: Path traversal via deferred symlinks during .deb extraction
Summary
BusyBox dpkg-deb, the applet that unpacks Debian .deb packages, flushes deferred symlinks after each ar archive member, unlike the tar, cpio and unzip handlers. A crafted .deb with two data.tar members can create a symlink to an absolute path and then write a file through it, outside the extraction directory. An attacker can therefore write arbitrary files to arbitrary locations, but only if a user or automated job extracts the crafted package with BusyBox dpkg-deb; no remote exploitation is described.
Affected
- Red Hat Hardened Images (listed as affected by default in the CVE record)
- Debian bookworm, trixie and forky entries in OSV (exact affected versions not verified)
- Azure Linux package busybox 1.36.1-27
- Ubuntu: all supported releases listed as Needs evaluation
- Upstream BusyBox version range: Unknown.
Fixed in
Unknown. No vendor fix version has been confirmed; check the distribution's security tracker for the patched package.
Workaround
- Do not use BusyBox dpkg-deb to extract untrusted .deb packages.
- Use the GNU dpkg-deb implementation for package inspection or extraction.
- If BusyBox dpkg-deb must be used, inspect .deb archives for more than one data.tar member before extraction; legitimate packages contain exactly one.
- In containers, remove BusyBox if the image does not need it.
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- No public proof of concept and no evidence of exploitation in the wild were found.
- EPSS is low (0.00197).
Our recommendation
- Identify systems, scripts, CI jobs and container images that run BusyBox dpkg-deb on .deb files.
- Stop extracting untrusted .deb packages with BusyBox until a fix is installed.
- Apply the distribution's BusyBox update as soon as it is published.
- Remove unneeded BusyBox from container images.
- Monitor extraction workflows for archives with multiple data.tar members.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE record CVE-2026-90954 access.redhat.com
- Red Hat Bugzilla 2533007 bugzilla.redhat.com
- OSV Debian CVE-2026-90954 osv.dev
- Ubuntu security CVE-2026-90954 ubuntu.com
- SUSE CVE via vulners (CVSS comparison) vulners.com
- BusyBox project busybox.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:58.
Original description (NVD)
A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this ordering: the first member declares a symlink pointing to an absolute path (e.g., '/'), which is deferred as unsafe but flushed after the first member. The second member declares a regular file whose path traverses the now-live symlink, resulting in a file being written outside the intended extraction directory. This could allow an attacker to write arbitrary files to arbitrary locations when a user extracts a crafted .deb package.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.