CVE-2011-5325: busybox Path Traversal
Vulnerability summary
CVE-2011-5325 is a high (CVSS 7.5) Path Traversal vulnerability in busybox. EPSS estimates a 6.98% chance of exploitation in the next 30 days, higher than 94% of scored vulnerabilities. 4 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 12 · Related 10Timeline
- 07-08-2017PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.
CVSS metrics
5 scores · 3 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
6.98%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
0.00 pp
From 6.98% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
4 foundExploit Reference (seclists.org)
Maturity: unknown
Exploit Reference (seclists.org)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian2 products
- busybox< 1:1.27.2-1
- debian_linuxEOL8.0 | 9.0
Busybox1 product
- busybox≤ 1.21.1
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 18.10
Ubuntu1 product
- busybox< 1:1.21.0-1ubuntu1.4 | < 1:1.22.0-15ubuntu1.4 | < 1:1.27.2-2ubuntu3
4 vendors · 5 products
References
14 links
lists.debian.org/debian-lts-announce/2018/07/msg00037.htmlMailing ListX Refsource MLISTThird Party Advisory- lists.debian.org/debian-lts-announce/2021/02/msg00020.htmlMailing ListX Refsource MLISTThird Party Advisory