CVE-2026-90954

Name of the Vulnerable Software and Affected Versions BusyBox (affected versions not specified)

Description A flaw exists in the dpkg-deb archive extraction process. The ar archive handler flushes deferred symlinks after each archive member, whereas other handlers like tar, cpio, and unzip only flush once after the final member. An attacker can exploit this by creating a specially crafted .deb archive containing two data.tar members. The first member defines a symlink to an absolute path (such as /), which is initially deferred but then flushed. The second member defines a regular file that traverses this active symlink, allowing the attacker to write arbitrary files to locations outside the intended extraction directory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.