BusyBox’s libarchive component fails to validate a user-supplied path before performing file operations, allowing a symlink in an extracted archive to point to an arbitrary location. When the archive is processed, the symlink causes the system to create or overwrite a file at that target path in the context of the BusyBox process. This flaw enables a remote attacker to write any file if they can supply a malicious archive and get the target to extract it or otherwise trigger libarchive. The weakness is reflected in CWE‑22 (Path Traversal) and CWE‑59 (Improper Validation of File/Path).

All deployments of BusyBox that include the affected libarchive code and that process external archives are at risk. The CVE description does not list specific kernel or BusyBox releases, so the damage is likely to span any build that incorporates the vulnerable libarchive path handling. Based on the description, it is inferred that no version details are disclosed, implying that users should consider current and prior versions until a vendor mitigation is confirmed.

The CVSS score of 6.1 marks the issue as moderate; the EPSS score is reported as less than 1 %, indicating a very low probability of exploitation at present. The vulnerability is not included in the CISA KEV catalog, suggesting it is not widely exploited. The attack vector requires the target to interact with a malicious archive or page, meaning user interaction is needed. Once triggered, the flaw permits the attacker to create files in the current user’s context, potentially enabling persistence, privilege escalation, or further compromise. No public exploit is known, but the ability to arbitrarily write files represents a significant foothold for adversaries.