The bug resides in busybox's tar applet where deferred link-creation for symlink and hardlink entries does not verify that the resolved final path remains within the target extraction directory once the link is created. Attackers can craft a tar archive using a symlink pointing to ".." together with a deferred hardlink to create or replace a file outside the extraction directory. The flaw can lead to privilege escalation or arbitrary code execution when the archive is extracted with elevated privileges. The weakness corresponds to CWE-59, unsafe relocation of file system objects.

The issue is present in BusyBox shipped with Red Hat Enterprise Linux 6 and Red Hat Hardened Images. No specific BusyBox version numbers are supplied, so any installation of BusyBox on those platforms that has not been updated beyond the current baseline is potentially vulnerable.

The CVSS score is 6.3, indicating moderate impact. No EPSS data is available and the vulnerability is not currently catalogued in CISA KEV. Exploitation requires the attacker to supply a crafted tar archive and perform the extraction process with elevated privileges. Thus the attack vector is local: an administrator or automated process that extracts untrusted archives using BusyBox with root or privileged access can trigger the flaw. Because the exploit depends on privilege level, the risk is significant for privileged or escalated contexts but absent for unprivileged users. Even without privileges, the flaw can still violate directory isolation, potentially leading to data leakage between extraction jobs.