CVE-2026-124745 Busybox: tar deferred hardlink target resolved through a deferred symlink escapes the extraction directory

A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links pointing outside the intended extraction directory. An attacker could provide a specially crafted archive that links to sensitive files outside the extracti...

CVE-2026-124745

A flaw in BusyBox 's tar utility allows for an improper link resolution (CWE-59) during archive extraction. Specifically, the utility fails to correctly resolve deferred hardlink targets when they are accessed through deferred symlinks pointing outside the intended extraction directory. A malicio...