CVE-2026-124738

A flaw was found in BusyBox. When the HTTP daemon httpd has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this flaw by requesting an uncompressed file pat...