{"id":"CVE-2022-4510","aliases":["DEBIAN-CVE-2022-4510","DLA-3339-1","DLA-4410-1","EUVD-2023-0317","GHSA-3cm8-v4mc-gppg","MGASA-2023-0074","PYSEC-2026-787","UBUNTU-CVE-2022-4510","openSUSE-SU-2024:12649-1"],"status":"published","title":"Path Traversal in binwalk","description":"A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction, would extract a malicious binwalk module into the folder .config/binwalk/plugins.\n This vulnerability is associated with program files src/binwalk/plugins/unpfs.py.\n\nThis issue affects binwalk from 2.1.2b through 2.3.3 included.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.2288,"percentile":0.97751,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-22"],"published":"2023-01-25T12:25:14Z","modified":"2026-11-03T06:03:01Z","exploits":[{"source":"pocgithub","id":"electr0sm0g/CVE-2022-4510","title":"electr0sm0g/CVE-2022-4510","date":"2023-02-06","url":"https://github.com/electr0sm0g/CVE-2022-4510"},{"source":"exploitdb","id":"EDB-51249","title":"Binwalk v2.3.2 - Remote Command Execution (RCE)","type":"remote","platform":"python","date":"2023-04-05","url":"https://www.exploit-db.com/exploits/51249"},{"source":"pocgithub","id":"adhikara13/CVE-2022-4510-WalkingPath","title":"adhikara13/CVE-2022-4510-WalkingPath","date":"2023-06-27","url":"https://github.com/adhikara13/CVE-2022-4510-WalkingPath"},{"source":"pocgithub","id":"Kalagious/BadPfs-CVE-2022-4510","title":"Kalagious/BadPfs-CVE-2022-4510","date":"2023-07-11","url":"https://github.com/Kalagious/BadPfs-CVE-2022-4510"}],"fixes":[{"ecosystem":"Debian:12","package":"binwalk","fixed_in":["2.3.4+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"binwalk","fixed_in":["2.3.4+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"binwalk","fixed_in":["2.3.4+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"binwalk","fixed_in":["2.1.2~git20180830+dfsg1-1+deb10u1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"binwalk","fixed_in":["2.3.1+dfsg1-1+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"binwalk","fixed_in":["2.3.4-1.mga8"],"sources":["osv"]},{"ecosystem":"PyPI","package":"binwalk","fixed_in":["2.3.4"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"binwalk","fixed_in":["2.3.3-2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"binwalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.2b"},{"last_affected":"2.3.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"binwalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"binwalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"binwalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"binwalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2~git20180830+dfsg1-1+deb10u1"}]}],"versions":["2.1.2~git20180830+dfsg1-1"]},{"source":"osv","ecosystem":"Debian:11","package":"binwalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1+dfsg1-1+deb11u1"}]}],"versions":["2.3.1+dfsg1-1"]},{"source":"osv","ecosystem":"PyPI","package":"binwalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.2b"},{"last_affected":"2.3.3"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"binwalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-1.mga8"}]}]},{"source":"osv","ecosystem":"PyPI","package":"binwalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.2b"},{"fixed":"2.3.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"binwalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+dfsg-1","2.0.1+dfsg-2","2.0.1+dfsg-3","2.1.1-1","2.1.1-2","2.1.1-3","2.1.1-4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"binwalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.1-16"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"binwalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.2~git20180830+dfsg1-1","2.2.0+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"binwalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.2+dfsg1-1","2.3.3+dfsg1-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"binwalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-2.1"}]}]}],"products":[{"vendor":"microsoft","product":"binwalk"},{"vendor":"ospg","product":"binwalk"},{"vendor":"refirm labs","product":"binwalk"}],"references":[{"url":"https://github.com/ReFirmLabs/binwalk/pull/617","tags":["x_transferred","Exploit","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://security.gentoo.org/glsa/202309-07","tags":["x_transferred","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/12/msg00022.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4510","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3cm8-v4mc-gppg","tags":["advisory"]},{"url":"https://github.com/ReFirmLabs/binwalk/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4510.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-4510","tags":["advisory"]},{"url":"https://github.com/ReFirmLabs/binwalk","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2023-0074.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31375","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/M2TTCIDC6ZNFMU5XFFFDFZEBHO2CU5NG/","tags":["web"]},{"url":"https://www.debian.org/lts/security/2023/dla-3339","tags":["web"]},{"url":"https://pypi.org/project/binwalk","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2022-4510","tags":["report"]},{"url":"https://github.com/ReFirmLabs/binwalk/commit/696fe34ed680ffd951bfeca737feb4a0b98dde5c","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-4510","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-4510","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-4510","title":"Path Traversal in binwalk","description":"A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction, would extract a malicious binwalk module into the folder .config/binwalk/plugins.\n This vulnerability is associated with program files src/binwalk/plugins/unpfs.py.\n\nThis issue affects binwalk from 2.1.2b through 2.3.3 included.","status":"published","published":"2023-01-25T12:25:14.811Z","modified":"2025-12-16T09:06:07.67Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:37.599536Z"}],"euvd":[{"id":"EUVD-2023-0317","description":"A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction, would extract a malicious binwalk module into the folder .config/binwalk/plugins.\n This vulnerability is associated with program files src/binwalk/plugins/unpfs.py.\n\nThis issue affects binwalk from 2.1.2b through 2.3.3 included.","status":"published","published":"2023-01-25T12:25:14Z","modified":"2025-12-16T09:06:07Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:05.078672Z"}],"ghsa":[{"id":"GHSA-3cm8-v4mc-gppg","title":"Path traversal in binwalk","description":"A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 inclusive. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction, would extract a malicious binwalk module into the folder .config/binwalk/plugins. This vulnerability is associated with program files src/binwalk/plugins/unpfs.py. This issue affects binwalk from 2.1.2b through and including 2.3.3.","status":"published","published":"2023-01-26T21:30:20Z","modified":"2025-12-20T02:33:01Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:39:14.093341Z"}],"nvd":[{"id":"CVE-2022-4510","description":"A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction, would extract a malicious binwalk module into the folder .config/binwalk/plugins.\n This vulnerability is associated with program files src/binwalk/plugins/unpfs.py.\n\nThis issue affects binwalk from 2.1.2b through 2.3.3 included.","status":"published","published":"2023-01-26T21:18:06.547Z","modified":"2026-06-17T05:21:04.38Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:07:35.561816Z"}],"osv":[{"id":"CVE-2022-4510","title":"Path Traversal in binwalk","description":"A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction, would extract a malicious binwalk module into the folder .config/binwalk/plugins.\n This vulnerability is associated with program files src/binwalk/plugins/unpfs.py.\n\nThis issue affects binwalk from 2.1.2b through 2.3.3 included.","status":"published","published":"2023-01-25T12:25:14.811Z","modified":"2026-10-28T02:30:30.587866687Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:27.481647Z"},{"id":"DEBIAN-CVE-2022-4510","description":"A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction, would extract a malicious binwalk module into the folder .config/binwalk/plugins.  This vulnerability is associated with program files src/binwalk/plugins/unpfs.py.  This issue affects binwalk from 2.1.2b through 2.3.3 included.","status":"published","published":"2023-01-26T21:18:06.547Z","modified":"2026-11-03T08:03:56.599142069Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T08:23:34.488036Z"},{"id":"GHSA-3cm8-v4mc-gppg","title":"Path traversal in binwalk","description":"A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 inclusive. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction, would extract a malicious binwalk module into the folder .config/binwalk/plugins. This vulnerability is associated with program files src/binwalk/plugins/unpfs.py. This issue affects binwalk from 2.1.2b through and including 2.3.3.","status":"published","published":"2023-01-26T21:30:20Z","modified":"2026-07-07T11:56:33.354430649Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"PYSEC-2026-787","title":"Path traversal in binwalk","description":"A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 inclusive. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction, would extract a malicious binwalk module into the folder .config/binwalk/plugins. This vulnerability is associated with program files src/binwalk/plugins/unpfs.py. This issue affects binwalk from 2.1.2b through and including 2.3.3.","status":"published","published":"2026-07-07T10:17:27.146365Z","modified":"2026-07-07T11:45:43.106389018Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.117212Z"},{"id":"UBUNTU-CVE-2022-4510","description":"A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction, would extract a malicious binwalk module into the folder .config/binwalk/plugins.  This vulnerability is associated with program files src/binwalk/plugins/unpfs.py. This issue affects binwalk from 2.1.2b through 2.3.3 included.","status":"published","published":"2023-01-26T21:18:00Z","modified":"2025-10-24T04:53:18Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:56.473586Z"},{"id":"DLA-3339-1","title":"binwalk - security update","status":"published","published":"2023-02-23T00:00:00Z","modified":"2026-03-09T01:18:53.878584Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DLA-4410-1","title":"binwalk - security update","status":"published","published":"2025-12-16T00:00:00Z","modified":"2025-12-16T08:44:58.541912Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2023-0074","title":"Updated binwalk packages fix security vulnerability","description":"Remote code execution using crafted PFS filesystem. (CVE-2022-4510)\n","status":"published","published":"2023-03-01T21:14:31Z","modified":"2026-04-16T04:40:50.043999814Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12649-1","title":"binwalk-2.3.3-2.1 on GA media","description":"These are all security issues fixed in the binwalk-2.3.3-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:28:58.009263Z","updated_at":"2026-11-02T16:58:35.751245Z"}]}}