PatchTheCVECVE-2026-92205: BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability
27
Routine
MEDIUM 6.1
CVE-2026-92205 is a medium-severity flaw (CVSS 6.1) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of BusyBox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the libarchive component. The issue results from the lack of proper validation of a user-sup
Why this priority
- No elevated risk signals yet
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 6.1 (Medium) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.3% (top 77%) |
| CISA exploited list | No |
| Weakness | CWE-22 |
| Published | 2026-10-21 |
| Last modified | 2026-10-22 |
Publisher (CNA): Zero Day Initiative
Timeline
- Published CVE record published
- Updated Record last modified
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.