CVE-2026-124744: Busybox: cpio hardlink target not sanitized under feature_path_traversal_protection
A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outside the intended extraction directory. This issue may allow an attacker to modify or overwrite arbitrary files outside the target directory during subsequent extraction operations.
Other sources
A flaw was found in BusyBox's cpio. When FEATUREPATHTRAVERSALPROTECTION is enabled, leading '/' and '../' sequences are stripped from the names of entries cpio creates, but hardlinked files are remembered under their archive name and that unsanitized name is passed as the link target. A crafted archive can therefore create a hardlink inside the extraction directory that refers to a file outside it, pulling an arbitrary outside file into the tree; a second archive extracted into the same directory with an overwriting extractor could then replace the outside file's content.
— Red Hat