CVE-2026-92205: Unpatched BusyBox libarchive Symlink Traversal Flaw Enables Arbitrary File Creation — Detection and Mitigation Guide

The Zero Day Initiative has published ZDI-26-705, disclosing a symlink directory traversal vulnerability in BusyBox's libarchive component — tracked as CVE-2026-92205 — that allows remote attackers to create arbitrary files on affected installations. The advisory carries a CVSS score of 6.1 and, critically, is being disclosed as an unpatched vulnerability. User interaction is required: the target must visit a malicious page or open a malicious file.

If you run embedded Linux, IoT devices, routers, NAS appliances, container base images, or any appliance shipping BusyBox — and in 2026, that is an enormous installed base — this advisory belongs on your desk today. Arbitrary file creation via archive extraction is one of the most reliable primitive-to-compromise escalation paths we see in real-world intrusions: overwrite a cron file, drop an authorized_keys entry, replace a library loaded by a privileged daemon. The 6.1 CVSS score undersells the blast radius when extraction runs as root, which it very often does in embedded contexts.

Why Defenders Should Take This Seriously Despite the Moderate CVSS

CVSS 6.1 reflects the user-interaction requirement and the file-write primitive in isolation. What the score cannot capture is context:

• BusyBox is everywhere. It is the default userspace for a vast share of embedded devices, firmware images, minimal container images, and network appliances. A single vulnerable component ships across millions of devices from hundreds of vendors, most of whom will be slow — or never — to ship a fix.
• Extraction often runs privileged. Firmware update routines, package installers, init scripts, and CI/CD pipelines frequently invoke BusyBox tar/cpio extraction as root with no path sanitization beyond what libarchive provides.
• Symlink traversal is a proven weaponization pattern. The technique — crafting an archive where a symlink entry points outside the extraction root, then following it with a subsequent file entry — has been exploited in the wild repeatedly across archive libraries over the past two decades. Defenders should treat this as a weaponizable primitive, not a theoretical bug.

Technical Analysis

Affected Component

The flaw resides in BusyBox's bundled libarchive-derived extraction logic — the code path used when BusyBox applets (notably tar and related archive handling) process archive members. Per ZDI-26-705, the specific defect is in how symlinks are handled during extraction, allowing a crafted archive to escape the intended extraction directory.

How the Attack Works (Defender's View)

The classic symlink traversal attack chain applies here:

1. Delivery: The attacker gets a malicious archive to the victim — via a phishing page prompting a download, a poisoned software package, a malicious firmware blob, a booby-trapped attachment, or a compromised upstream artifact (supply-chain angle).
2. User interaction: The victim (or an automated process operating on user-fetched content) extracts the archive using the vulnerable BusyBox archive-handling code.
3. Symlink planting: The archive contains a symlink entry pointing to a location outside the extraction root — e.g., link -> /etc/cron.d/ or link -> /root/.ssh/.
4. Traversal write: A subsequent archive member is written through that symlink, landing an attacker-controlled file at an arbitrary path on the filesystem, constrained only by the privileges of the extracting process.
5. Post-write leverage: Depending on the written path, the attacker achieves persistence (cron, init scripts, systemd units), code execution (overwriting binaries or shared libraries loaded by daemons), or account takeover (authorized_keys, shadow manipulation where permissions allow).

Exploitation Status

• Patch status: Unpatched at the time of the ZDI disclosure. No upstream fix is available yet — this is a zero-day disclosure under ZDI's coordinated disclosure timeline.
• CVE: CVE-2026-92205.
• CVSS: 6.1 (Medium), reflecting required user interaction.
• Active exploitation / CISA KEV: No confirmed in-the-wild exploitation or CISA KEV listing has been reported alongside this advisory at publication time. Treat this window — between public disclosure and widespread patching — as the highest-risk period, because PoC development for archive traversal bugs is historically fast and low-effort.

Exposure Surface Check

You are likely exposed if any of the following are true:

• Devices or containers run BusyBox versions including the vulnerable libarchive-derived code path (assume all current versions until upstream confirms otherwise).
• Any workflow extracts archives with BusyBox tar/cpio/unzip applets against untrusted content — firmware update paths, package managers on embedded distros, initramfs tooling, minimal container images (e.g., busybox-based images) used in build pipelines.
• Users on BusyBox-based systems handle downloaded archives directly.

Detection & Response

Because the vulnerability is unpatched, detection and behavioral controls are your primary defense. The most reliable observables are: (1) symlink-traversal write patterns during archive extraction, (2) unexpected file creation in sensitive directories by extraction processes, and (3) BusyBox archive applets spawning unexpected follow-on activity.

Sigma Rules

These rules target the behavior, not the bug — they will remain useful even after a patch ships, because symlink-traversal extraction is a technique, not a signature.

---
title: Archive Extraction Writing to Sensitive System Paths
tid: 3f8a1c92-7d4e-4b6a-9c21-5e0f8a2b3d44
status: experimental
description: Detects archive extraction utilities (tar, cpio, unzip, busybox applets) creating or modifying files in sensitive system directories, consistent with symlink directory traversal arbitrary file creation (ZDI-26-705 / CVE-2026-92205).
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-705/
  - https://attack.mitre.org/techniques/T1505/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1505
logsource:
  category: file_event
  product: linux
detection:
  selection_image:
    Image|endswith:
      - '/tar'
      - '/cpio'
      - '/unzip'
      - '/busybox'
      - '/rpm'
      - '/dpkg'
  selection_paths:
    TargetFilename|contains:
      - '/etc/cron'
      - '/etc/init.d/'
      - '/etc/systemd/'
      - '/root/.ssh/'
      - '/home/'
      - '/etc/ld.so'
      - '/usr/lib/'
      - '/etc/passwd'
      - '/etc/shadow'
      - '/etc/rc'
  condition: selection_image and selection_paths
falsepositives:
  - Legitimate package installation and firmware updates - baseline and tune per package manager
level: high
---
title: BusyBox Tar Extraction of Untrusted Archive Followed by Command Execution
id: 8c2e5f17-9a3b-4d68-bf34-7c1d9e0a5f66
status: experimental
description: Detects BusyBox archive applet (tar/cpio) execution that spawns an interactive shell or script interpreter child process, indicating potential post-exploitation after malicious archive extraction (CVE-2026-92205 attack chain).
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-705/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/busybox'
      - '/tar'
      - '/cpio'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/wget'
      - '/curl'
  condition: selection_parent and selection_child
falsepositives:
  - Build systems and packaging scripts that invoke interpreters during extraction - investigate parent chain
level: medium
---
title: Symlink Created in Extraction Directory Pointing Outside Extraction Root
id: 61b9d4e8-2c7f-4a53-8e19-4d6c2b8f1a77
status: experimental
description: Detects creation of symbolic links whose targets resolve to absolute system paths shortly after archive extraction activity, a hallmark of symlink directory traversal staging (ZDI-26-705).
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-705/
  - https://attack.mitre.org/techniques/T1546/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.persistence
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|startswith:
      - '/etc/'
      - '/root/'
      - '/usr/bin/'
      - '/usr/sbin/'
      - '/var/spool/cron'
  filter_tmp:
    Image|endswith:
      - '/dpkg'
      - '/rpm'
      - '/apt'
  condition: selection and not filter_tmp
falsepositives:
  - System administration and package maintenance - correlate with extraction process lineage
level: medium

Tuning note: Rule one will fire during legitimate dpkg/rpm/firmware-update activity. The value is in the correlation: an extraction process not tied to your package manager or a known update window writing to /etc/cron.d or authorized_keys paths is almost never benign. Baseline your update tooling first, then alert on the remainder.

KQL — Microsoft Sentinel / Defender

For Linux endpoints forwarding Syslog/auditd (including execve and file events via auditd or eBPF-based agents) into Sentinel, hunt for extraction processes touching sensitive paths:

// Hunt: archive extraction processes writing to sensitive system paths (CVE-2026-92205 behavior)
let SensitivePaths = dynamic(["/etc/cron", "/etc/init.d", "/etc/systemd", "/root/.ssh", "/etc/ld.so", "/var/spool/cron", "/etc/passwd", "/etc/shadow"]);
let Extractors = dynamic(["/tar", "/cpio", "/unzip", "/busybox"]);
union (
    DeviceFileEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFolderPath has_any (Extractors) or FolderPath has_any (Extractors)
    | where FolderPath has_any (SensitivePaths)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, ActionType, InitiatingProcessAccountName
),
(
    Syslog
    | where TimeGenerated > ago(7d)
    | where SyslogMessage has_any (SensitivePaths) and SyslogMessage has_any ("tar", "cpio", "unzip", "busybox")
    | project TimeGenerated, Computer, ProcessName, SyslogMessage
)
| order by TimeGenerated desc

Also hunt for extraction processes spawning shells — the post-exploitation tell:

// Hunt: BusyBox/archive tools spawning shell or interpreter children
let Extractors = dynamic(["tar", "cpio", "unzip", "busybox"]);
let Shells = dynamic(["sh", "bash", "dash", "python", "python3", "perl", "nc", "wget", "curl"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (Extractors)
| where FileName in~ (Shells)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc

Velociraptor VQL

For DFIR triage of a suspected compromised embedded/Linux host, this artifact pulls process lineage around archive tools and enumerates recently modified files in the classic traversal target directories:

-- Hunt: archive extraction activity and suspicious file writes in sensitive paths (CVE-2026-92205)
-- Part 1: running or recent extraction processes
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(tar|cpio|unzip|busybox)'
   OR CommandLine =~ '(tar|cpio|unzip)\s+.*-[xz]'

-- Part 2: files modified in traversal target directories in the last 7 days
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['/etc/cron.d/*', '/etc/cron.daily/*', '/etc/systemd/system/*',
                 '/etc/init.d/*', '/root/.ssh/*', '/var/spool/cron/*'])
WHERE Mtime > (now() - 604800)
ORDER BY Mtime DESC

-- Part 3: symlinks pointing to sensitive absolute paths in common extraction locations
SELECT FullPath, Data.symlink_target AS SymlinkTarget
FROM glob(globs=['/tmp/**/*', '/var/tmp/**/*', '/home/*/**/*'], accessor='file')
WHERE IsLink AND SymlinkTarget =~ '^/(etc|root|usr/bin|usr/sbin|var/spool)'

Deploy as a hunt across your Linux fleet if you ingest BusyBox-based appliances via their management interfaces or any Linux hosts handling untrusted archives.

Verification / Hardening Script

Until a patch ships, run this across Linux and embedded management hosts to inventory exposure and flag suspicious extraction artifacts:

#!/bin/bash
# CVE-2026-92205 / ZDI-26-705 exposure check and hardening audit
# Run as root. Safe: read-only checks plus optional noexec mount recommendations.

echo "=== [1] BusyBox presence and version ==="
if command -v busybox >/dev/null 2>&1; then
  busybox | head -2
  echo "BusyBox path: $(command -v busybox)"
else
  echo "busybox binary not in PATH (check /bin/busybox, /sbin/busybox, firmware)"
  ls -la /bin/busybox /sbin/busybox 2>/dev/null
fi

echo ""
echo "=== [2] Archive applets symlinked to busybox ==="
for app in tar cpio unzip; do
  for p in /bin /sbin /usr/bin /usr/sbin; do
    [ -e "$p/$app" ] && ls -la "$p/$app" | grep -q busybox && echo "VULNERABLE PATH: $p/$app -> busybox"
  done
done

echo ""
echo "=== [3] Recently modified files in traversal target dirs (last 7 days) ==="
find /etc/cron.d /etc/cron.daily /etc/init.d /etc/systemd/system /root/.ssh /var/spool/cron \
  -type f -mtime -7 -ls 2>/dev/null || echo "none found / dirs absent"

echo ""
echo "=== [4] Suspicious symlinks in extraction staging areas ==="
find /tmp /var/tmp /home -xdev -type l -lname '/etc/*' -o -type l -lname '/root/*' 2>/dev/null | head -50

echo ""
echo "=== [5] Extraction processes currently running ==="
ps aux | grep -E '[t]ar |[c]pio|[u]nzip|[b]usybox' || echo "none running"

echo ""
echo "=== RECOMMENDED HARDENING (apply manually per environment) ==="
cat <<'EOF'
1. Mount /tmp and /var/tmp with noexec,nosuid,nodev to blunt payload staging.
2. Where possible, replace BusyBox tar extraction of untrusted archives with a
   patched extractor (GNU tar with --no-overwrite-dir, or bsdtar with sandboxing),
   or extract inside a chroot/container with a read-only root filesystem.
3. Enforce: never extract untrusted archives as root. Use a dedicated unprivileged
   extraction user, then validate contents before promotion.
4. Enable auditd rules watching sensitive dirs:
     auditctl -w /etc/cron.d -p wa -k traversal_watch
     auditctl -w /root/.ssh -p wa -k traversal_watch
     auditctl -w /etc/systemd/system -p wa -k traversal_watch
5. Monitor ZDI-26-705 and upstream BusyBox for the fix; patch immediately on release.
EOF

Remediation

Because no patch exists yet, your remediation plan is layered:

Immediate (this week)

1. Inventory exposure. Identify every asset running BusyBox: embedded devices, firmware images, container base images (docker images | grep -i busybox), network appliances, NAS units. You cannot protect what you have not enumerated.
2. Block the delivery vector. The exploit requires a malicious archive to be opened. Tighten email/web filtering on archive attachments (.tar, .tar.gz, .tgz, .cpio, .zip) destined for BusyBox-based systems and build pipelines. Flag archives containing symlink entries with absolute targets at the gateway where tooling permits.
3. Constrain extraction. Mandate that untrusted archives are never extracted as root. Use an unprivileged extraction user or a disposable container with a read-only rootfs and no sensitive mounts.
4. Deploy the detections above — particularly file-event monitoring on cron/systemd/ssh paths with archive-process correlation.
5. Auditd watches on high-value write targets (see script section 5).

Near-term

6. Substitute extractors in automated pipelines: where firmware/package flows use BusyBox tar on untrusted input, swap in GNU tar/bsdtar with explicit --anchored-style path validation or extract to an isolated staging directory and validate every member's resolved path before use.
7. Vendor outreach. For appliances shipping BusyBox (router/NAS/IoT vendors), open tickets demanding patch timelines referencing ZDI-26-705 / CVE-2026-92205. Vendor pressure is the only path to fixed firmware on closed platforms.

When the patch lands

8. Monitor the ZDI advisory (http://www.zerodayinitiative.com/advisories/ZDI-26-705/) and the BusyBox project (https://busybox.net/) for the fixed release. Patch priority: (a) internet-facing and archive-handling systems, (b) build/CI infrastructure, (c) embedded fleet via firmware update cycles.
9. Post-patch validation. Re-run the verification script; confirm the vulnerable applet code path is replaced and that your detection rules did not fire during the exposure window.

Compromise assessment

If you find evidence of traversal writes — unexpected files in /etc/cron.d, modified authorized_keys, new systemd units — treat it as a full incident: isolate the host, capture memory and filesystem artifacts (the VQL artifact above is a starting point), and hunt laterally, because arbitrary file write as root is a persistence-and-pivot primitive, not an end state.

Bottom Line

CVE-2026-92205 is a 6.1 on paper and a much bigger problem in practice: an unpatched arbitrary-file-creation primitive in one of the most widely deployed userspace toolkits on the planet. The user-interaction requirement will not save automated extraction pipelines, firmware update flows, or distracted admins. Your defense this month is behavioral detection and extraction hardening; your defense next month is a vendor patch that does not exist yet. Plan for both.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub