{"id":"CVE-2023-39810","aliases":["AZL-61539","AZL-61600","BELL-CVE-2023-39810","CLSA-2025-1762269073","CLSA-2026-1777368104","DEBIAN-CVE-2023-39810","EUVD-2023-43510","GHSA-mm53-x3wx-jgr2","OESA-2025-1855","OESA-2025-1856","OESA-2025-1857","OESA-2025-1884","OESA-2025-1885","OESA-2025-1886","UBUNTU-CVE-2023-39810","openSUSE-SU-2026:11256-1"],"status":"published","title":"An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.","description":"An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00765,"percentile":0.55889,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2023-08-28T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:2","package":"busybox","fixed_in":["1.35.0-14"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"busybox","fixed_in":["1.36.1-12"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"busybox","fixed_in":["1.35.0-r34"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"busybox","fixed_in":["1.37.0-r22"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"busybox","fixed_in":["1.37.0-r24"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"busybox","fixed_in":["1.35.0-r34"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"busybox","fixed_in":["1.37.0-r22"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"busybox","fixed_in":["1.37.0-r24"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"busybox","fixed_in":["1:1.30.1-4ubuntu6.5+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"busybox-initramfs","fixed_in":["1:1.30.1-4ubuntu6.5+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"busybox-static","fixed_in":["1:1.30.1-4ubuntu6.5+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"busybox-syslogd","fixed_in":["1:1.30.1-4ubuntu6.5+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"udhcpc","fixed_in":["1:1.30.1-4ubuntu6.5+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"udhcpd","fixed_in":["1:1.30.1-4ubuntu6.5+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"busybox","fixed_in":["1:1.37.0-7"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"busybox","fixed_in":["1.36.1-9.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"busybox","fixed_in":["1.36.1-9.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"busybox","fixed_in":["1.36.1-9.oe2403"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"busybox","fixed_in":["1.38.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-14"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.1-12"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.35.0-r29"},{"fixed":"1.35.0-r34"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.37.0-r20"},{"fixed":"1.37.0-r22"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.36.1-r1"},{"fixed":"1.37.0-r24"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.35.0-r29"},{"fixed":"1.35.0-r34"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.37.0-r20"},{"fixed":"1.37.0-r22"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.36.1-r1"},{"fixed":"1.37.0-r24"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"busybox-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"busybox-syslogd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"udhcpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"udhcpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4ubuntu6.5+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"busybox-initramfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4ubuntu6.5+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"busybox-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4ubuntu6.5+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"busybox-syslogd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4ubuntu6.5+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"udhcpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4ubuntu6.5+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"udhcpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4ubuntu6.5+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.35.0-4","1:1.35.0-4+deb12u1","1:1.36.0-1~exp1","1:1.36.1-1","1:1.36.1-2","1:1.36.1-3","1:1.36.1-3.1","1:1.36.1-4","1:1.36.1-5","1:1.36.1-6","1:1.36.1-6~exp.1","1:1.36.1-7","1:1.36.1-8","1:1.36.1-9","1:1.37.0-1","1:1.37.0-10","1:1.37.0-10.1","1:1.37.0-2","1:1.37.0-3","1:1.37.0-4","1:1.37.0-5","1:1.37.0-6","1:1.37.0-7","1:1.37.0-8","1:1.37.0-9","1:1.38.0-1","1:1.38.0-2","1:1.38.0-3"]},{"source":"osv","ecosystem":"Debian:13","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.37.0-10","1:1.37.0-10.1","1:1.37.0-6","1:1.37.0-7","1:1.37.0-8","1:1.37.0-9","1:1.38.0-1","1:1.38.0-2","1:1.38.0-3"]},{"source":"osv","ecosystem":"Debian:14","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.37.0-7"}]}],"versions":["1:1.37.0-6"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.1-9.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.1-9.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.1-9.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.1-25.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-25.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-25.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.20.0-8.1ubuntu1","1:1.20.0-9ubuntu1","1:1.20.0-9ubuntu2","1:1.21.0-1ubuntu1","1:1.21.0-1ubuntu1.4","1:1.21.0-1ubuntu1.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.22.0-15ubuntu1","1:1.22.0-15ubuntu1.4","1:1.22.0-15ubuntu1.4+esm1","1:1.22.0-15ubuntu1.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.22.0-19ubuntu2","1:1.27.2-1ubuntu3","1:1.27.2-1ubuntu4","1:1.27.2-2ubuntu2","1:1.27.2-2ubuntu3","1:1.27.2-2ubuntu3.1","1:1.27.2-2ubuntu3.2","1:1.27.2-2ubuntu3.3","1:1.27.2-2ubuntu3.4","1:1.27.2-2ubuntu3.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.30.1-4ubuntu4","1:1.30.1-4ubuntu5","1:1.30.1-4ubuntu6","1:1.30.1-4ubuntu6.1","1:1.30.1-4ubuntu6.2","1:1.30.1-4ubuntu6.3","1:1.30.1-4ubuntu6.4","1:1.30.1-4ubuntu6.5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.30.1-6ubuntu3","1:1.30.1-7ubuntu1","1:1.30.1-7ubuntu2","1:1.30.1-7ubuntu3","1:1.30.1-7ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.36.1-3ubuntu1","1:1.36.1-6ubuntu1","1:1.36.1-6ubuntu3","1:1.36.1-6ubuntu3.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.38.0-1.1"}]}]}],"products":[{"vendor":"busybox","product":"busybox"}],"references":[{"url":"https://www.pentagrid.ch/en/blog/busybox-cpio-directory-traversal-vulnerability/","tags":["x_transferred","Third Party Advisory","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2025/04/23/1","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/04/23/2","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/04/23/3","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/04/24/2","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39810","tags":["web","advisory"]},{"url":"http://busybox.com"},{"url":"https://www.pentagrid.ch/en/blog/busybox-cpio-directory-traversal-vulnerability"},{"url":"https://github.com/advisories/GHSA-mm53-x3wx-jgr2"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-39810","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2025-1762269073.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1777368104.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39810.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-39810","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1855","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1856","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1857","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1884","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46394","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1885","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1886","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-39810","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39810","tags":["report"]},{"url":"http://lists.busybox.net/pipermail/busybox/2024-August/090865.html","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39810","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-39810","description":"An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.","status":"published","published":"2023-08-28T00:00:00Z","modified":"2026-07-09T00:27:51.768Z","updated_at":"2026-11-02T14:35:33.462059Z"}],"euvd":[{"id":"EUVD-2023-43510","description":"An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.","status":"published","published":"2023-08-28T00:00:00Z","modified":"2026-07-09T00:27:51Z","updated_at":"2026-11-02T18:20:05.755223Z"}],"ghsa":[{"id":"GHSA-mm53-x3wx-jgr2","title":"An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.","description":"An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.","status":"published","published":"2023-08-28T21:31:06Z","modified":"2025-04-24T21:31:47Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:02:01.717603Z"}],"nvd":[{"id":"CVE-2023-39810","description":"An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.","status":"published","published":"2023-08-28T19:15:07.893Z","modified":"2026-07-09T01:18:36.67Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:08:25.025396Z"}],"osv":[{"id":"AZL-61539","title":"CVE-2023-39810 affecting package busybox for versions less than 1.35.0-14","description":"An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.","status":"published","published":"2023-08-28T19:15:07Z","modified":"2026-04-21T04:31:40.18606Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"AZL-61600","title":"CVE-2023-39810 affecting package busybox for versions less than 1.36.1-12","description":"An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.","status":"published","published":"2023-08-28T19:15:07Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:21.344052Z"},{"id":"BELL-CVE-2023-39810","status":"published","published":"2023-08-28T19:15:00Z","modified":"2026-01-26T09:33:34.573036Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"DEBIAN-CVE-2023-39810","description":"An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.","status":"published","published":"2023-08-28T19:15:07.893Z","modified":"2026-10-26T18:02:31.308018451Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"OESA-2025-1855","title":"busybox security update","description":"BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.\r\n\r\nSecurity Fix(es):\n\nAn issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.(CVE-2023-39810)","status":"published","published":"2025-07-18T11:08:56Z","modified":"2026-08-18T01:18:54.462558809Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1856","title":"busybox security update","description":"BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.\r\n\r\nSecurity Fix(es):\n\nAn issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.(CVE-2023-39810)","status":"published","published":"2025-07-18T11:08:56Z","modified":"2026-08-18T01:18:53.962454897Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1857","title":"busybox security update","description":"BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.\r\n\r\nSecurity Fix(es):\n\nAn issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.(CVE-2023-39810)","status":"published","published":"2025-07-18T11:08:56Z","modified":"2026-08-18T01:18:54.28416212Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1884","title":"busybox security update","description":"BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.\r\n\r\nSecurity Fix(es):\n\nAn issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.(CVE-2023-39810)\n\nIn tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.(CVE-2025-46394)","status":"published","published":"2025-07-25T11:08:58Z","modified":"2026-08-18T01:18:54.798611552Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1885","title":"busybox security update","description":"BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.\r\n\r\nSecurity Fix(es):\n\nAn issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.(CVE-2023-39810)\n\nIn tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.(CVE-2025-46394)","status":"published","published":"2025-07-25T11:08:58Z","modified":"2026-08-18T01:18:54.784463924Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1886","title":"busybox security update","description":"BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.\r\n\r\nSecurity Fix(es):\n\nAn issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.(CVE-2023-39810)\n\nIn tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.(CVE-2025-46394)","status":"published","published":"2025-07-25T11:08:58Z","modified":"2026-08-18T01:18:54.91598881Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"UBUNTU-CVE-2023-39810","description":"An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.","status":"published","published":"2023-08-28T19:15:00Z","modified":"2026-01-20T17:40:51.769105Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"CLSA-2025-1762269073","title":"Fix CVE(s): CVE-2018-1000500, CVE-2022-28391, CVE-2023-39810","description":"   * SECURITY UPDATE: missing SSL certificate validation vulnerability in wget\n     - debian/patches/CVE-2018-1000500-1.patch: implement TLS verification with\n       CENABLE_FEATURE_WGET_OPENSSL\n     - debian/patches/CVE 2018-1000500-2.patch: fix openssl options for cert verification\n     - CVE-2018-1000500\n   * SECURITY UPDATE: escape sequence injection attack\n     - debian/patches/CVE-2022-28391-1.patch: sockaddr2str: ensure only printable\n       characters are returned for the hostname part\n     - debian/patches/CVE-2022-28391-2.patch: nslookup: sanitize all printed strings\n     - CVE-2022-28391\n   * SECURITY UPDATE: directory traversal vulnerability in CPIO command\n     - debian/patches/CVE-2023-39810.patch: archival: disallow path traversals\n     - debian/config/pkg/*: regenerate to add the new FEATURE_PATH_TRAVERSAL_PROTECTION\n       option\n     - CVE-2023-39810","status":"published","published":"2025-11-04T15:11:26Z","modified":"2026-06-04T10:03:46.390436Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2026-1777368104","title":"Fix CVE(s): CVE-2023-39810","description":"   * SECURITY UPDATE: directory traversal in cpio extraction\n     - debian/patches/CVE-2023-39810.patch: add FEATURE_PATH_TRAVERSAL_PROTECTION\n       config option, call strip_unsafe_prefix() in data_extract_all.c to prevent\n       path traversal via ../ in archive filenames. Covers cpio, ar, rpm.\n     - Enable CONFIG_FEATURE_PATH_TRAVERSAL_PROTECTION=y in all build configs.\n     - debian/patches/CVE-2023-39810.patch: replace `echo -e` with `printf` in\n       the new cpio path-traversal testcase so it is portable to dash (the\n       Ubuntu /bin/sh).\n     - debian/testsuite-linux.diff: skip the pre-existing\n       \"cpio uses by default uid/gid\" test, which is fragile in the pbuilder\n       chroot (id -u returns 0 but source files retain uid=1000 from the\n       build worker, causing a spurious mismatch).\n     - debian/patches/CVE-2023-39810.patch: include the \"1 blocks\" summary\n       line that busybox cpio -vi emits (to stderr, merged via 2\u003e\u00261) at\n       end-of-archive in the expected output of the new path-traversal\n       testcase; the functional check (file not written, exit 0) already\n       passed but the string-match failed because 1.30.1 always prints\n       \"N blocks\", matching the pattern used by other cpio tests in\n       testsuite/cpio.tests.\n     - debian/testsuite-linux.diff: skip the pre-existing hostname-d-works\n       test when the pbuilder chroot cannot resolve its own hostname via DNS\n       (no /etc/hosts entry for the build host).\n     - CVE-2023-39810","status":"published","published":"2026-04-28T09:21:49Z","modified":"2026-06-04T10:03:56.994483Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CVE-2023-39810","description":"An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.","status":"published","published":"2023-08-28T00:00:00Z","modified":"2026-10-28T02:30:26.593522402Z","updated_at":"2026-11-02T15:44:33.244128Z"},{"id":"openSUSE-SU-2026:11256-1","title":"busybox-1.38.0-1.1 on GA media","description":"These are all security issues fixed in the busybox-1.38.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-12T00:00:00Z","modified":"2026-07-13T09:00:10.069346045Z","updated_at":"2026-11-02T16:58:38.95195Z"}]}}