Every CVE Search/ Get API key

CVE-2025-46394

In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through...

3.2 LowFix available

In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.18%Up 0.2 points since Apr 24, 2025
90%50%10%1%

What each source reports

CVE List Score used 3.2

In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.

Record
CVE-2025-46394
CVSS 3.1
3.2 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Weakness
CWE-451
Updated
2026-11-02
EUVDEUVD-2025-11984 3.2

In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.

Record
EUVD-2025-11984
CVSS 3.1
3.2 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-wp4q-9jq4-gv74 3.2

In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through...

In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.

Record
GHSA-wp4q-9jq4-gv74
CVSS 3.1
3.2 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Weakness
CWE-451
Updated
2026-11-02
NVD 3.2

In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.

Record
CVE-2025-46394
CVSS 3.1
3.2 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-451
Updated
2026-11-02
OSVALPINE-CVE-2025-46394 3.3

In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.

Record
ALPINE-CVE-2025-46394
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVBELL-CVE-2025-46394 3.3
Record
BELL-CVE-2025-46394
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
Show 18 moreShow less
OSV 3.3

In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.

Record
CVE-2025-46394
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2025-46394 3.3

In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.

Record
DEBIAN-CVE-2025-46394
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVOESA-2025-1881 6.3

busybox security update

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.

Security Fix(es):

In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.(CVE-2025-46394)

Record
OESA-2025-1881
CVSS 3.1
6.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVOESA-2025-1882 6.3

busybox security update

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.

Security Fix(es):

In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.(CVE-2025-46394)

Record
OESA-2025-1882
CVSS 3.1
6.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVOESA-2025-1883 6.3

busybox security update

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.

Security Fix(es):

In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.(CVE-2025-46394)

Record
OESA-2025-1883
CVSS 3.1
6.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVOESA-2025-1884 7.8

busybox security update

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.

Security Fix(es):

An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.(CVE-2023-39810)

In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.(CVE-2025-46394)

Record
OESA-2025-1884
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2025-1885 7.8

busybox security update

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.

Security Fix(es):

An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.(CVE-2023-39810)

In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.(CVE-2025-46394)

Record
OESA-2025-1885
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2025-1886 7.8

busybox security update

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.

Security Fix(es):

An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.(CVE-2023-39810)

In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.(CVE-2025-46394)

Record
OESA-2025-1886
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-46394 3.2

In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.

Record
UBUNTU-CVE-2025-46394
CVSS 3.1
3.2 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVAZL-60936 No score

CVE-2025-46394 affecting package busybox 1.36.1-28

In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.

Record
AZL-60936
Updated
2026-11-05
OSVAZL-61191 No score

CVE-2025-46394 affecting package busybox 1.35.0-18

In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.

Record
AZL-61191
Updated
2026-11-02
OSVopenSUSE-SU-2025:15834-1 No score

busybox-1.37.0-8.1 on GA media

These are all security issues fixed in the busybox-1.37.0-8.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15834-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20090-1 No score

Security update for busybox

This update for busybox fixes the following issues:

Security fixes:

  • CVE-2025-60876: HTTP request header injection in wget (bsc#1253245).
  • CVE-2025-46394: Fixed tar hidden files via escape sequence (bsc#1241661).

Other fixes:

  • Set CONFIG_FIRST_SYSTEM_ID to 201 to avoid confclict (bsc#1236670)
  • Fix unshare -mrpf sh core dump on ppc64le (bsc#1249237)
Record
openSUSE-SU-2026:20090-1
Updated
2026-11-02
OSVSUSE-SU-2026:0235-1 No score

Security update for busybox

This update for busybox fixes the following issues:

Security issues:

  • CVE-2025-46394: Fixed tar hidden files via escape sequence (CVE-2025-46394, bsc#1241661)
  • CVE-2025-60876: Fixed HTTP request header injection in wget (CVE-2025-60876, bsc#1253245)

Other issues:

  • Set CONFIG_FIRST_SYSTEM_ID to 201 to avoid confclict (bsc#1236670)
  • Fixed unshare -mrpf sh core dump on ppc64le (bsc#1249237)
Record
SUSE-SU-2026:0235-1
Updated
2026-11-02
OSVSUSE-SU-2026:0236-1 No score

Security update for busybox

This update for busybox fixes the following issues:

This update for busybox fixes the following issues:

Security issues:

  • CVE-2025-46394: Fixed tar hidden files via escape sequence (CVE-2025-46394, bsc#1241661)
  • CVE-2025-60876: Fixed HTTP request header injection in wget (CVE-2025-60876, bsc#1253245)

Other issues:

  • Set CONFIG_FIRST_SYSTEM_ID to 201 to avoid confclict (bsc#1236670)
  • Fixed unshare -mrpf sh core dump on ppc64le (bsc#1249237)
  • Fixed adduser inside containers on an SELinux host (bsc#1247779)
Record
SUSE-SU-2026:0236-1
Updated
2026-11-02
OSVSUSE-SU-2026:0872-1 No score

Security update for busybox

This update for busybox fixes the following issues:

  • CVE-2023-42363: use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580).
  • CVE-2023-42364: use-after-free in the awk.c evaluate function (bsc#1217584).
  • CVE-2023-42365: use-after-free in the awk.c copyvar function (bsc#1217585).
  • CVE-2025-46394: files in a TAR archive can have their filenames hidden from a listing if terminal escape sequences are used when naming other files included in the archive (bsc#1241661).
  • CVE-2025-60876: request line incorrectly neutralized mat lead to header injection (bsc#1253245).
  • CVE-2026-26157: Arbitrary file overwrite and potential code execution via incomplete path sanitization (bsc#1258163).
  • CVE-2026-26158: Arbitrary file modification and privilege escalation via unvalidated tar archive entries (bsc#1258167).
  • CVE-2021-42380: Additional fix for use-after-realloc in awk (bsc#1192869).
Record
SUSE-SU-2026:0872-1
Updated
2026-11-02
OSVSUSE-SU-2026:0892-1 No score

Security update for busybox

This update for busybox fixes the following issues:

  • CVE-2023-42363: use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580).
  • CVE-2023-42364: use-after-free in the awk.c evaluate function (bsc#1217584).
  • CVE-2023-42365: use-after-free in the awk.c copyvar function (bsc#1217585).
  • CVE-2025-46394: files in a TAR archive can have their filenames hidden from a listing if terminal escape sequences are used when naming other files included in the archive (bsc#1241661).
  • CVE-2025-60876: request line incorrectly neutralized mat lead to header injection (bsc#1253245).
  • CVE-2026-26157: Arbitrary file overwrite and potential code execution via incomplete path sanitization (bsc#1258163).
  • CVE-2026-26158: Arbitrary file modification and privilege escalation via unvalidated tar archive entries (bsc#1258167).
  • CVE-2021-42380: Additional fix for use-after-realloc in awk (bsc#1192869).
Record
SUSE-SU-2026:0892-1
Updated
2026-11-02
OSVSUSE-SU-2026:20134-1 No score

Security update for busybox

This update for busybox fixes the following issues:

Security fixes:

  • CVE-2025-60876: HTTP request header injection in wget (bsc#1253245).
  • CVE-2025-46394: Fixed tar hidden files via escape sequence (bsc#1241661).

Other fixes:

  • Set CONFIG_FIRST_SYSTEM_ID to 201 to avoid confclict (bsc#1236670)
  • Fix unshare -mrpf sh core dump on ppc64le (bsc#1249237)
Record
SUSE-SU-2026:20134-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
busybox
Alpine:v3.19
 before 1.36.1-r21
1.36.1-r21
busybox
Alpine:v3.20
 before 1.36.1-r31
1.36.1-r31
busybox
Alpine:v3.21
 before 1.37.0-r14
1.37.0-r14
busybox
Alpine:v3.22
 before 1.37.0-r20
1.37.0-r20
busybox
Alpine:v3.23
 before 1.37.0-r27
1.37.0-r27
busybox
Alpine:v3.24
 before 1.37.0-r27
1.37.0-r27
busybox
Azure Linux:3
 through 1.36.1-28 None known
busybox
Azure Linux:2
 through 1.35.0-18 None known
busybox
Alpaquita:23
 1.35.0-r29 up to 1.35.0-r35
1.35.0-r35
busybox
Alpaquita:25
 1.37.0-r20 up to 1.37.0-r23
1.37.0-r23
Show 41 moreShow less
Affected packages
PackageAffectedFixed
busybox
Alpaquita:stream
 1.36.1-r1 up to 1.37.0-r27
1.37.0-r27
busybox
BellSoft Hardened Containers:23
 1.35.0-r29 up to 1.35.0-r35
1.35.0-r35
busybox
BellSoft Hardened Containers:25
 1.37.0-r20 up to 1.37.0-r23
1.37.0-r23
busybox
BellSoft Hardened Containers:stream
 1.36.1-r1 up to 1.37.0-r27
1.37.0-r27
busybox
Debian:12
 All versions, plus listed versions
1:1.35.0-41:1.35.0-4+deb12u11:1.36.0-1~exp11:1.36.1-11:1.36.1-2
Show 23 moreShow less
1:1.36.1-31:1.36.1-3.11:1.36.1-41:1.36.1-51:1.36.1-61:1.36.1-6~exp.11:1.36.1-71:1.36.1-81:1.36.1-91:1.37.0-11:1.37.0-101:1.37.0-10.11:1.37.0-21:1.37.0-31:1.37.0-41:1.37.0-51:1.37.0-61:1.37.0-71:1.37.0-81:1.37.0-91:1.38.0-11:1.38.0-21:1.38.0-3
 None known
busybox
Debian:13
 All versions, plus listed versions
1:1.37.0-101:1.37.0-10.11:1.37.0-61:1.37.0-71:1.37.0-8
Show 4 moreShow less
1:1.37.0-91:1.38.0-11:1.38.0-21:1.38.0-3
 None known
busybox
Debian:14
 before 1:1.37.0-8, plus listed versions
1:1.37.0-61:1.37.0-7
1:1.37.0-8
busybox
openEuler:24.03-LTS
 before 1.36.1-11.oe2403
1.36.1-11.oe2403
busybox
openEuler:24.03-LTS-SP1
 before 1.36.1-11.oe2403sp1
1.36.1-11.oe2403sp1
busybox
openEuler:24.03-LTS-SP2
 before 1.36.1-11.oe2403sp2
1.36.1-11.oe2403sp2
busybox
openEuler:20.03-LTS-SP4
From an advisory covering 2 CVEs
 before 1.31.1-25.oe2003sp4
1.31.1-25.oe2003sp4
busybox
openEuler:22.03-LTS-SP3
From an advisory covering 2 CVEs
 before 1.34.1-25.oe2203sp3
1.34.1-25.oe2203sp3
busybox
openEuler:22.03-LTS-SP4
From an advisory covering 2 CVEs
 before 1.34.1-25.oe2203sp4
1.34.1-25.oe2203sp4
busybox
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 2 CVEs
 before 1.37.0-150700.18.10.1
1.37.0-150700.18.10.1
busybox
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 2 CVEs
 before 1.37.0-150500.10.14.1
1.37.0-150500.10.14.1
busybox
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 1.37.0-150500.10.14.1
1.37.0-150500.10.14.1
busybox
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 1.37.0-150500.10.14.1
1.37.0-150500.10.14.1
busybox
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 2 CVEs
 before 1.37.0-150500.10.14.1
1.37.0-150500.10.14.1
busybox
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 2 CVEs
 before 1.37.0-150500.10.14.1
1.37.0-150500.10.14.1
busybox
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 2 CVEs
 before 1.37.0-150500.10.14.1
1.37.0-150500.10.14.1
busybox
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 1.37.0-150500.10.14.1
1.37.0-150500.10.14.1
busybox-links
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 1.37.0-150500.7.9.1
1.37.0-150500.7.9.1
busybox
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 8 CVEs
 before 1.35.0-150400.3.14.1
1.35.0-150400.3.14.1
busybox
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 8 CVEs
 before 1.35.0-150400.3.14.1
1.35.0-150400.3.14.1
busybox
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 8 CVEs
 before 1.35.0-150400.3.14.1
1.35.0-150400.3.14.1
busybox
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 8 CVEs
 before 1.35.0-150400.3.14.1
1.35.0-150400.3.14.1
busybox
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 8 CVEs
 before 1.35.0-10.3.1
1.35.0-10.3.1
busybox
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 8 CVEs
 before 1.35.0-10.3.1
1.35.0-10.3.1
busybox
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 1.37.0-160000.4.1
1.37.0-160000.4.1
busybox
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 1.37.0-160000.4.1
1.37.0-160000.4.1
busybox
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1:1.20.0-8.1ubuntu11:1.20.0-9ubuntu11:1.20.0-9ubuntu21:1.21.0-1ubuntu11:1.21.0-1ubuntu1.41:1.21.0-1ubuntu1.4+esm1
 None known
busybox
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1:1.22.0-15ubuntu11:1.22.0-15ubuntu1.41:1.22.0-15ubuntu1.4+esm11:1.22.0-15ubuntu1.4+esm2
 None known
busybox
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1:1.22.0-19ubuntu21:1.27.2-1ubuntu31:1.27.2-1ubuntu41:1.27.2-2ubuntu21:1.27.2-2ubuntu3
Show 5 moreShow less
1:1.27.2-2ubuntu3.11:1.27.2-2ubuntu3.21:1.27.2-2ubuntu3.31:1.27.2-2ubuntu3.41:1.27.2-2ubuntu3.4+esm1
 None known
busybox
Ubuntu:20.04:LTS
 All versions, plus listed versions
1:1.30.1-4ubuntu41:1.30.1-4ubuntu51:1.30.1-4ubuntu61:1.30.1-4ubuntu6.11:1.30.1-4ubuntu6.21:1.30.1-4ubuntu6.31:1.30.1-4ubuntu6.41:1.30.1-4ubuntu6.5
 None known
busybox
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:1.30.1-6ubuntu31:1.30.1-7ubuntu11:1.30.1-7ubuntu21:1.30.1-7ubuntu31:1.30.1-7ubuntu3.1
 None known
busybox
Ubuntu:24.04:LTS
 All versions, plus listed versions
1:1.36.1-3ubuntu11:1.36.1-6ubuntu11:1.36.1-6ubuntu31:1.36.1-6ubuntu3.1
 None known
busybox
Ubuntu:25.10
 All versions, plus listed versions
1:1.37.0-4ubuntu1
 None known
busybox
Ubuntu:26.10
 All versions, plus listed versions
1:1.37.0-7ubuntu11:1.37.0-10.1ubuntu21:1.37.0-10.1ubuntu31:1.38.0-3ubuntu11:1.38.0-3ubuntu31:1.38.0-3ubuntu4
 None known
busybox
Ubuntu:26.04:LTS
 All versions, plus listed versions
1:1.37.0-4ubuntu11:1.37.0-7ubuntu1
 None known
busybox
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 1.37.0-8.1
1.37.0-8.1
busybox
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 1.37.0-160000.4.1
1.37.0-160000.4.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-46394 is a low vulnerability (CVSS 3.2) in Busybox, published April 23, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in busybox 1.36.1-r21.

References

Show 41 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open