Bug 2571625 (CVE-2026-124744)

Summary: CVE-2026-124744 busybox: cpio hardlink target not sanitized under FEATURE_PATH_TRAVERSAL_PROTECTION
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outside the intended extraction directory. This issue may allow an attacker to modify or overwrite arbitrary files outside the target directory during subsequent extraction operations.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-11 09:56:15 UTC 
A flaw was found in BusyBox's cpio. When FEATURE_PATH_TRAVERSAL_PROTECTION is enabled, leading '/' and '../' sequences are stripped from the names of entries cpio creates, but hardlinked files are remembered under their archive name and that unsanitized name is passed as the link target. A crafted archive can therefore create a hardlink inside the extraction directory that refers to a file outside it, pulling an arbitrary outside file into the tree; a second archive extracted into the same directory with an overwriting extractor could then replace the outside file's content.