ZDI 2026-09-16

ZDI-26-705: (0Day) BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability

CVE-2026-92205

Machine-generated analysis · WAYSCloud LLM

BusyBox's libarchive component can be abused via a symlink directory traversal to create arbitrary files.

Context

The advisory affects BusyBox's libarchive library. It describes a symlink directory traversal that enables remote attackers to create arbitrary files, requiring the victim to visit a malicious page or open a malicious file. The advisory assigns a CVSS score of 6.1 (CVE-2026-92205).

Operator considerations

- Check: inventory BusyBox installations that include libarchive.
- Log: monitor for unexpected file creation events associated with BusyBox.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to create arbitrary files on affected installations of BusyBox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 6.1. The following CVEs are assigned: CVE-2026-92205.

Read the full advisory on ZDI →