Threats tagged 'ghsa-5jg6-27f2-v2xm'

A vulnerability in BusyBox's cpio utility with path traversal protection enabled allows improper sanitization of hardlink target paths. This flaw can enable an attacker to create hardlinks pointing outside the intended extraction directory, potentially modifying or overwriting arbitrary files during extraction. Exploitation requires tricking a user or automated process into extracting a crafted archive. The issue is rated medium severity with a CVSS score of 6.3. Red Hat notes limited exposure due to BusyBox's specialized use in their distributions and the complexity of exploitation. No official fix or mitigation is currently available from Red Hat.