PT-2023-27118

CVE-2023-39810

Published

2023-08-28

Updated

2026-07-12

Description by

CVSS 3.1

7.8

High

MetricsAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Busybox version 1.33.2

Description An issue in the CPIO command of Busybox allows attackers to execute a directory traversal.

Recommendations For Busybox version 1.33.2, consider disabling the CPIO command until a patch is available. Restrict access to the CPIO command to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Martin Schobert

Tobias Ospelt

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers

CVE-2023-39810