# CVE-2026-92205: BusyBox libarchive symlink directory traversal arbitrary file creation

Source: https://junglewise.ai/threats/cve-2026-92205-busybox-libarchive-symlink-directory-traversal-arbitrary-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-92205 · Severity: medium · CVSS 6.1 · Published 2026-10-21

BusyBox is a lightweight utility suite commonly embedded in IoT devices, embedded systems, and containers. This vulnerability in its libarchive component allows an attacker to create arbitrary files on an affected system if a user opens a malicious file or visits a malicious page, potentially leading to system compromise or data corruption.

Technologies: [Busybox](https://junglewise.ai/threats/technologies/busybox). Vendors: [Busybox](https://junglewise.ai/threats/vendors/busybox).

## Quick answers

**Is CVE-2026-92205 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92205 being exploited in the wild.

**How severe is CVE-2026-92205?** Medium severity, with a CVSS score of 6.1, published 21 October 2026.

**Which products and versions are affected?** BusyBox BusyBox.

**Is there a fix for CVE-2026-92205?** No fixed version is recorded yet. Restrict user interaction with untrusted archive files until a patch is available; avoid opening or processing archive files from untrusted sources.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2025-10-03"}, {"kind": "advisory", "at": "2026-09-16"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92205 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-92205?** Check whether you run Busybox. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Restrict user interaction with untrusted archive files until a patch is available; avoid opening or processing archive files from untrusted sources.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2025-10-03"}, {"kind": "advisory", "at": "2026-09-16"}]

## Technical details

The vulnerability exists in BusyBox's libarchive component due to insufficient validation of user-supplied file paths before use in file operations. This allows symlink-based directory traversal to create files outside the intended directory. Exploitation requires user interaction (opening a malicious file or visiting a malicious page), and the attacker gains the ability to create files with the privileges of the current user.

## Affected products

- BusyBox BusyBox

## References

- [https://www.zerodayinitiative.com/advisories/ZDI-26-705/](https://www.zerodayinitiative.com/advisories/ZDI-26-705/)

## Related threats

- [BusyBox divide-by-zero in volume identification FAT parser](https://junglewise.ai/threats/cve-2026-124742-a-flaw-was-found-in-busybox-the-volume-identification-component)
- [BusyBox httpd stack buffer overflow in subdirectory config](https://junglewise.ai/threats/cve-2026-124739-a-flaw-was-found-in-busybox-when-the-httpd-web-server-processes)
- [BusyBox heap buffer overflow in TFTP client](https://junglewise.ai/threats/cve-2026-124737-a-flaw-was-found-in-busybox-when-the-tftp-trivial-file-transfer)
- [BusyBox udhcpc integer underflow in DHCP packet processing](https://junglewise.ai/threats/cve-2026-88833-a-flaw-was-found-in-busybox-s-udhcpc-dhcp-client-when-processing)
- [BusyBox TLS out-of-bounds read in ClientHello parsing](https://junglewise.ai/threats/cve-2026-88840-busybox-tls-get-client-hello-reads-past-the-end-of-the-input)