A flaw was found in BusyBox's cpio. When FEATURE_PATH_TRAVERSAL_PROTECTION is enabled, leading '/' and '../' sequences are stripped from the names of entries cpio creates, but hardlinked files are remembered under their archive name and that unsanitized name is passed as the link target. A crafted archive can therefore create a hardlink inside the extraction directory that refers to a file outside it, pulling an arbitrary outside file into the tree; a second archive extracted into the same directory with an overwriting extractor could then replace the outside file's content.