# CVE-2026-90954: BusyBox dpkg-deb path traversal in archive extraction

Source: https://junglewise.ai/threats/cve-2026-90954-a-flaw-was-found-in-busybox-s-dpkg-deb-archive-extraction-the-ar  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-90954 · Severity: high · CVSS 7.8 · Published 2026-10-14

BusyBox is a lightweight version of Linux utilities used in embedded systems, containers, and build environments. A flaw in its dpkg-deb package extraction tool allows an attacker to write files outside the intended directory when a user extracts a specially crafted .deb package, potentially compromising system integrity or enabling code execution.

Technologies: [BusyBox](https://junglewise.ai/threats/technologies/x-busybox).

## Quick answers

**Is CVE-2026-90954 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90954 being exploited in the wild.

**How severe is CVE-2026-90954?** High severity, with a CVSS score of 7.8, published 14 October 2026.

**Which products and versions are affected?** BusyBox all versions with dpkg-deb applet enabled.

**Is there a fix for CVE-2026-90954?** No fixed version is recorded yet. Do not use BusyBox dpkg-deb to extract untrusted .deb packages; use Debian's reference dpkg-deb implementation instead. If BusyBox dpkg-deb must be used, inspect .deb archives for multiple data.tar members before extraction, as legitimate packages contain exactly one.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-14"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90954 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-90954?** Check whether you run BusyBox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Do not use BusyBox dpkg-deb to extract untrusted .deb packages; use Debian's reference dpkg-deb implementation instead. If BusyBox dpkg-deb must be used, inspect .deb archives for multiple data.tar members before extraction, as legitimate packages contain exactly one.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-14"}]

## Technical details

The vulnerability exploits improper symlink handling in BusyBox's ar archive handler, which flushes deferred symlinks after each archive member rather than at extraction completion. An attacker crafts a .deb archive with two data.tar members: the first declares an unsafe symlink to an absolute path (e.g., '/'), and after the first member's processing, this symlink becomes active. The second member then traverses this symlink to write a regular file outside the extraction directory. This requires the user to extract an untrusted .deb file, and a fix is available by using Debian's reference dpkg-deb implementation.

## Affected products

- BusyBox all versions with dpkg-deb applet enabled

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-90954](https://access.redhat.com/security/cve/CVE-2026-90954)

## Related threats

- [BusyBox integer overflow in volume_id](https://junglewise.ai/threats/cve-2026-124746-a-flaw-was-found-in-busybox-an-integer-overflow-occurs-in-the)
- [BusyBox tar hardlink resolution path traversal](https://junglewise.ai/threats/cve-2026-124745-a-flaw-was-found-in-busybox-when-extracting-an-archive-the-tar)
- [BusyBox cpio hardlink path traversal vulnerability](https://junglewise.ai/threats/cve-2026-124744-a-flaw-was-found-in-busybox-when-extracting-files-using-the-cpio)
- [BusyBox divide-by-zero in HFS+ filesystem parsing](https://junglewise.ai/threats/cve-2026-124743-a-flaw-was-found-in-busybox-when-processing-filesystem-metadata)
- [BusyBox udhcpc6 use-after-free in DHCPv6 client](https://junglewise.ai/threats/cve-2026-124740-a-flaw-was-found-in-busybox-s-udhcpc6-dhcpv6-client-a-malicious)