CVE-2023-39810
An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.
An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.
- Record
CVE-2023-39810- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.
- Record
CVE-2023-39810- Updated
- 2026-11-02
EUVDEUVD-2023-43510 No score
An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.
- Record
EUVD-2023-43510- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mm53-x3wx-jgr2
An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.
An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.
- Record
GHSA-mm53-x3wx-jgr2- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVAZL-61539
CVE-2023-39810 affecting package busybox for versions less than 1.35.0-14
An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.
- Record
AZL-61539- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-61600
CVE-2023-39810 affecting package busybox for versions less than 1.36.1-12
An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.
- Record
AZL-61600- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
Show 13 moreShow less
OSVBELL-CVE-2023-39810
- Record
BELL-CVE-2023-39810- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-39810
An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.
- Record
DEBIAN-CVE-2023-39810- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-1855
busybox security update
BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.
Security Fix(es):
An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.(CVE-2023-39810)
- Record
OESA-2025-1855- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-1856
busybox security update
BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.
Security Fix(es):
An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.(CVE-2023-39810)
- Record
OESA-2025-1856- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-1857
busybox security update
BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.
Security Fix(es):
An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.(CVE-2023-39810)
- Record
OESA-2025-1857- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-1884
busybox security update
BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.
Security Fix(es):
An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.(CVE-2023-39810)
In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.(CVE-2025-46394)
- Record
OESA-2025-1884- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-1885
busybox security update
BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.
Security Fix(es):
An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.(CVE-2023-39810)
In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.(CVE-2025-46394)
- Record
OESA-2025-1885- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-1886
busybox security update
BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.
Security Fix(es):
An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.(CVE-2023-39810)
In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.(CVE-2025-46394)
- Record
OESA-2025-1886- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-39810
An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.
- Record
UBUNTU-CVE-2023-39810- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2025-1762269073 No score
Fix CVE(s): CVE-2018-1000500, CVE-2022-28391, CVE-2023-39810
- SECURITY UPDATE: missing SSL certificate validation vulnerability in wget
- debian/patches/CVE-2018-1000500-1.patch: implement TLS verification with CENABLE_FEATURE_WGET_OPENSSL
- debian/patches/CVE 2018-1000500-2.patch: fix openssl options for cert verification
- CVE-2018-1000500
- SECURITY UPDATE: escape sequence injection attack
- debian/patches/CVE-2022-28391-1.patch: sockaddr2str: ensure only printable characters are returned for the hostname part
- debian/patches/CVE-2022-28391-2.patch: nslookup: sanitize all printed strings
- CVE-2022-28391
- SECURITY UPDATE: directory traversal vulnerability in CPIO command
- debian/patches/CVE-2023-39810.patch: archival: disallow path traversals
- debian/config/pkg/*: regenerate to add the new FEATURE_PATH_TRAVERSAL_PROTECTION option
- CVE-2023-39810
- Record
CLSA-2025-1762269073- Updated
- 2026-11-02
OSVCLSA-2026-1777368104 No score
Fix CVE(s): CVE-2023-39810
- SECURITY UPDATE: directory traversal in cpio extraction
- debian/patches/CVE-2023-39810.patch: add FEATURE_PATH_TRAVERSAL_PROTECTION config option, call strip_unsafe_prefix() in data_extract_all.c to prevent path traversal via ../ in archive filenames. Covers cpio, ar, rpm.
- Enable CONFIG_FEATURE_PATH_TRAVERSAL_PROTECTION=y in all build configs.
- debian/patches/CVE-2023-39810.patch: replace
echo -ewithprintfin the new cpio path-traversal testcase so it is portable to dash (the Ubuntu /bin/sh). - debian/testsuite-linux.diff: skip the pre-existing "cpio uses by default uid/gid" test, which is fragile in the pbuilder chroot (id -u returns 0 but source files retain uid=1000 from the build worker, causing a spurious mismatch).
- debian/patches/CVE-2023-39810.patch: include the "1 blocks" summary line that busybox cpio -vi emits (to stderr, merged via 2>&1) at end-of-archive in the expected output of the new path-traversal testcase; the functional check (file not written, exit 0) already passed but the string-match failed because 1.30.1 always prints "N blocks", matching the pattern used by other cpio tests in testsuite/cpio.tests.
- debian/testsuite-linux.diff: skip the pre-existing hostname-d-works test when the pbuilder chroot cannot resolve its own hostname via DNS (no /etc/hosts entry for the build host).
- CVE-2023-39810
- Record
CLSA-2026-1777368104- Updated
- 2026-11-02
OSV No score
An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.
- Record
CVE-2023-39810- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11256-1 No score
busybox-1.38.0-1.1 on GA media
These are all security issues fixed in the busybox-1.38.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11256-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
busyboxAzure Linux:2 |
before 1.35.0-14 | 1.35.0-14 |
busyboxAzure Linux:3 |
before 1.36.1-12 | 1.36.1-12 |
busyboxAlpaquita:23 |
1.35.0-r29 up to 1.35.0-r34 | 1.35.0-r34 |
busyboxAlpaquita:25 |
1.37.0-r20 up to 1.37.0-r22 | 1.37.0-r22 |
busyboxAlpaquita:stream |
1.36.1-r1 up to 1.37.0-r24 | 1.37.0-r24 |
busyboxBellSoft Hardened Containers:23 |
1.35.0-r29 up to 1.35.0-r34 | 1.35.0-r34 |
busyboxBellSoft Hardened Containers:25 |
1.37.0-r20 up to 1.37.0-r22 | 1.37.0-r22 |
busyboxBellSoft Hardened Containers:stream |
1.36.1-r1 up to 1.37.0-r24 | 1.37.0-r24 |
busyboxTuxCare:Debian:10 From an advisory covering 3 CVEs |
before 1:1.30.1-4+tuxcare.els3 | 1:1.30.1-4+tuxcare.els3 |
busybox-staticTuxCare:Debian:10 From an advisory covering 3 CVEs |
before 1:1.30.1-4+tuxcare.els3 | 1:1.30.1-4+tuxcare.els3 |
Show 25 moreShow less
| Package | Affected | Fixed |
|---|---|---|
busybox-syslogdTuxCare:Debian:10 From an advisory covering 3 CVEs |
before 1:1.30.1-4+tuxcare.els3 | 1:1.30.1-4+tuxcare.els3 |
udhcpcTuxCare:Debian:10 From an advisory covering 3 CVEs |
before 1:1.30.1-4+tuxcare.els3 | 1:1.30.1-4+tuxcare.els3 |
udhcpdTuxCare:Debian:10 From an advisory covering 3 CVEs |
before 1:1.30.1-4+tuxcare.els3 | 1:1.30.1-4+tuxcare.els3 |
busyboxTuxCare:Ubuntu:20.04 |
before 1:1.30.1-4ubuntu6.5+tuxcare.els1 | 1:1.30.1-4ubuntu6.5+tuxcare.els1 |
busybox-initramfsTuxCare:Ubuntu:20.04 |
before 1:1.30.1-4ubuntu6.5+tuxcare.els1 | 1:1.30.1-4ubuntu6.5+tuxcare.els1 |
busybox-staticTuxCare:Ubuntu:20.04 |
before 1:1.30.1-4ubuntu6.5+tuxcare.els1 | 1:1.30.1-4ubuntu6.5+tuxcare.els1 |
busybox-syslogdTuxCare:Ubuntu:20.04 |
before 1:1.30.1-4ubuntu6.5+tuxcare.els1 | 1:1.30.1-4ubuntu6.5+tuxcare.els1 |
udhcpcTuxCare:Ubuntu:20.04 |
before 1:1.30.1-4ubuntu6.5+tuxcare.els1 | 1:1.30.1-4ubuntu6.5+tuxcare.els1 |
udhcpdTuxCare:Ubuntu:20.04 |
before 1:1.30.1-4ubuntu6.5+tuxcare.els1 | 1:1.30.1-4ubuntu6.5+tuxcare.els1 |
busyboxDebian:12 |
All versions, plus listed versions 1:1.35.0-41:1.35.0-4+deb12u11:1.36.0-1~exp11:1.36.1-11:1.36.1-2 Show 23 moreShow less1:1.36.1-31:1.36.1-3.11:1.36.1-41:1.36.1-51:1.36.1-61:1.36.1-6~exp.11:1.36.1-71:1.36.1-81:1.36.1-91:1.37.0-11:1.37.0-101:1.37.0-10.11:1.37.0-21:1.37.0-31:1.37.0-41:1.37.0-51:1.37.0-61:1.37.0-71:1.37.0-81:1.37.0-91:1.38.0-11:1.38.0-21:1.38.0-3 |
None known |
busyboxDebian:13 |
All versions, plus listed versions 1:1.37.0-101:1.37.0-10.11:1.37.0-61:1.37.0-71:1.37.0-8 Show 4 moreShow less1:1.37.0-91:1.38.0-11:1.38.0-21:1.38.0-3 |
None known |
busyboxDebian:14 |
before 1:1.37.0-7, plus listed versions 1:1.37.0-6 |
1:1.37.0-7 |
busyboxopenEuler:24.03-LTS-SP1 |
before 1.36.1-9.oe2403sp1 | 1.36.1-9.oe2403sp1 |
busyboxopenEuler:24.03-LTS-SP2 |
before 1.36.1-9.oe2403sp2 | 1.36.1-9.oe2403sp2 |
busyboxopenEuler:24.03-LTS |
before 1.36.1-9.oe2403 | 1.36.1-9.oe2403 |
busyboxopenEuler:20.03-LTS-SP4 From an advisory covering 2 CVEs |
before 1.31.1-25.oe2003sp4 | 1.31.1-25.oe2003sp4 |
busyboxopenEuler:22.03-LTS-SP3 From an advisory covering 2 CVEs |
before 1.34.1-25.oe2203sp3 | 1.34.1-25.oe2203sp3 |
busyboxopenEuler:22.03-LTS-SP4 From an advisory covering 2 CVEs |
before 1.34.1-25.oe2203sp4 | 1.34.1-25.oe2203sp4 |
busyboxUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1:1.20.0-8.1ubuntu11:1.20.0-9ubuntu11:1.20.0-9ubuntu21:1.21.0-1ubuntu11:1.21.0-1ubuntu1.41:1.21.0-1ubuntu1.4+esm1 |
None known |
busyboxUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1:1.22.0-15ubuntu11:1.22.0-15ubuntu1.41:1.22.0-15ubuntu1.4+esm11:1.22.0-15ubuntu1.4+esm2 |
None known |
busyboxUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1:1.22.0-19ubuntu21:1.27.2-1ubuntu31:1.27.2-1ubuntu41:1.27.2-2ubuntu21:1.27.2-2ubuntu3 Show 5 moreShow less1:1.27.2-2ubuntu3.11:1.27.2-2ubuntu3.21:1.27.2-2ubuntu3.31:1.27.2-2ubuntu3.41:1.27.2-2ubuntu3.4+esm1 |
None known |
busyboxUbuntu:20.04:LTS |
All versions, plus listed versions 1:1.30.1-4ubuntu41:1.30.1-4ubuntu51:1.30.1-4ubuntu61:1.30.1-4ubuntu6.11:1.30.1-4ubuntu6.21:1.30.1-4ubuntu6.31:1.30.1-4ubuntu6.41:1.30.1-4ubuntu6.5 |
None known |
busyboxUbuntu:22.04:LTS |
All versions, plus listed versions 1:1.30.1-6ubuntu31:1.30.1-7ubuntu11:1.30.1-7ubuntu21:1.30.1-7ubuntu31:1.30.1-7ubuntu3.1 |
None known |
busyboxUbuntu:24.04:LTS |
All versions, plus listed versions 1:1.36.1-3ubuntu11:1.36.1-6ubuntu11:1.36.1-6ubuntu31:1.36.1-6ubuntu3.1 |
None known |
busyboxopenSUSE:Tumbleweed |
before 1.38.0-1.1 | 1.38.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-39810 is a high vulnerability (CVSS 7.8) in Busybox, published August 28, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.77%, the 55th percentile. Fixed in busybox 1.35.0-14.
References
pentagrid.ch/en/blog/busybox-cpio-directory-traversal-vulnerability
openwall.com/lists/oss-security/2025/04/23/1
nvd.nist.gov/vuln/detail/CVE-2023-39810
Show 18 moreShow less
busybox.com
github.com/advisories/GHSA-mm53-x3wx-jgr2
docs.bell-sw.com/security/cves/CVE-2023-39810
errata.tuxcare.com/els_os/debian10els/CLSA-2025-1762269073.html
security-tracker.debian.org/tracker/CVE-2023-39810
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-1855
ubuntu.com/security/CVE-2023-39810
cve.org/CVERecord?id=CVE-2023-39810
lists.busybox.net/pipermail/busybox/2024-August/090865.html
suse.com/security/cve/CVE-2023-39810