Hi,

The following vulnerability was published for binwalk.

CVE-2026-7179[0]:
| A security vulnerability has been detected in OSPG binwalk up to
| 2.4.3. This vulnerability affects the function
| read_null_terminated_string of the file
| src/binwalk/plugins/winceextract.py of the component WinCE
| Extraction Plugin. Such manipulation of the argument self.file_name
| leads to path traversal. The attack can only be performed from a
| local environment. The exploit has been disclosed publicly and may
| be used. The project maintainer confirms this issue: "I accept the
| existence of the Path Traversal vulnerability. However, as stated in
| the Github link, it reached EOL and as a result no actions should be
| expected." The GitHub repository mentions, that "[u]sers and
| contributors should migrate to binwalk v3." This vulnerability only
| affects products that are no longer supported by the maintainer.

https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/binwalk_path_traversal.md

This sounds like binwalk shouldn't be included in forky?



If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-7179
https://www.cve.org/CVERecord?id=CVE-2026-7179

Please adjust the affected versions in the BTS as needed.

Hi,

I propose a lightweight downstream patch to fix CVE-2026-7179 in binwalk 2.4.3 (Bug #1136010).
The change is isolated to `src/binwalk/plugins/winceextract.py` and uses `os.path.realpath()` + `os.path.commonpath()` to ensure extracted filenames cannot escape the intended extraction directory; traversal attempts are logged and skipped.
This preserves legitimate nested extractions and avoids a naive `basename()` rewrite.

I would be happy if someone could sponsor to land this patch in unstable (debian/patches) to protect users, while I work in parallel on packaging the maintained Rust rewrite (binwalk3) as a longer‑term replacement.

Best regards,
Fukui

Just started looking after it.

Thanks for your contribution!

Sven

Hello,

Bug #1136010 in binwalk reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/pkg-security-team/binwalk/-/commit/d67da01607537aa6ecf88affba66472b65c29052
------------------------------------------------------------------------
d/p/*: Add prevent-path-traversal-in-wince.patch fixing CVE-2026-7179.

Closes: #1136010
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1136010

We believe that the bug you reported is fixed in the latest version of
binwalk, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1136010@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sven Geuer <sge@debian.org> (supplier of updated binwalk package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 26 Aug 2026 14:53:07 +0200
Source: binwalk
Architecture: source
Version: 2.4.3+dfsg1-3
Distribution: unstable
Urgency: medium
Maintainer: Debian Security Tools <team+pkg-security@tracker.debian.org>
Changed-By: Sven Geuer <sge@debian.org>
Closes: 1136010
Changes:
 binwalk (2.4.3+dfsg1-3) unstable; urgency=medium
 .
   * Team upload.
   * d/p/*: Add prevent-path-traversal-in-wince.patch fixing CVE-2026-7179;
     thanks to Fukui Daichi for providing the patch (Closes: #1136010).
   * d/watch: Update it to version 5 format.
   * d/control:
     - Drop 'Priority: optional'.
     - Drop 'Rules-Requires-Root: no'.
     - Bump Standards-Version to 4.7.4.
   * Bump debhelper-compat.
     - d/control:
       - Update debhelper-compat to 14.
       - Drop all ${*:Depends} substvar mentionings.
     - d/docs: Rename it to python3-binwalk.docs.
     - d/examples: Rename it to python3-binwalk.examples.
   * d/copyright: Add packaging copyrights.
Checksums-Sha1:
 a6484e6394fc9342ff62e1eb5f63114b74bf65a0 2221 binwalk_2.4.3+dfsg1-3.dsc
 940796f4eab0cca498c4b4a6e909e803f31a8be9 8828 binwalk_2.4.3+dfsg1-3.debian.tar.xz
 97bac58bbcb4ca4bc7e90c77bf83e3490341a2a4 7029 binwalk_2.4.3+dfsg1-3_amd64.buildinfo
Checksums-Sha256:
 5a8a9332f3f7c036c3308deed1d8c839cf17e4daf12ecba60510fed4d34f5157 2221 binwalk_2.4.3+dfsg1-3.dsc
 17a9f758b7944995a0ccd1a6382c16880bceb61c2a60a6ed6809c35b9baf5fff 8828 binwalk_2.4.3+dfsg1-3.debian.tar.xz
 50ee1697e1616a22b45740c0f4a808948eab760287688ead9f218a7e7f211d37 7029 binwalk_2.4.3+dfsg1-3_amd64.buildinfo
Files:
 ddcdf42067e559c4086e019cfca90587 2221 devel optional binwalk_2.4.3+dfsg1-3.dsc
 6d99a4e8e4e1990846604bd15b0aa9b1 8828 devel optional binwalk_2.4.3+dfsg1-3.debian.tar.xz
 65bb74c578e2d62bb74ccecd6104dc6a 7029 devel optional binwalk_2.4.3+dfsg1-3_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJDBAEBCgAtFiEEPfXoqkP8n9/QhvGVrfUO2vit1YUFAmqO45gPHHNnZUBkZWJp
YW4ub3JnAAoJEK31Dtr4rdWFTyQP/3pfICgmITq3aIpSDG8dxvUhXWlNjCndApJy
5pZOHWJcCmhOSEE8qut6fxumjLP1wnXxF7gpn4YvyNEkHR8WVt0U4rg3mApWOGWs
XMl5t0wQw0RnBoqFSqwmGkeDmBkcSYQC1yiEDWa1GrV/RZplu1V4OU1fc0eqV4WI
hR+Fv8fixdWaiKaiOL9ylwhPu+xz/ItdOIIDZU2FoiZkLoeVV8Yjho5q6izC6cHI
H/62qHARdqJXGRJCEecVVRV74XsTMp3z3mYhFtcrzx4xSEMfXAdqZYVYb3Vc0mWh
3u0w9nsvGROKrHJl1AKb92qDjm5+hov5kwnkyTCsX1IueaDXnUC3iePow1DJrwUQ
w9UQxDUY3PtnAYcvVHUmUNCXPNmMrI8IF5JO6LdA43YMGjzNJf9mFqcVN2PnnbRm
jxgu871ckPEpdjfw/srSi++Lz3CjW+XIV0JCXhPuzliMUPaOQq3CtzWORCRmTFWk
mnKVeDhklkZaWsOinPG1cFJCzpNaoq9smVLyueRqOSDmRgY6s4xmpvIVC9dvpyH2
u1fEqmAvCMwt77WQLkYikhj+bXfNT0jd6IT/wcjVitw1Rs7x0J7F9hd2ZYzbtJrw
BuvvwC+eTDUuQ0I6jJx4QrlhBJ752WZe03aNJaJKOPR0UbUBUYIkb3G+Kn7PR2zk
EG6/CTej
=mPAY
-----END PGP SIGNATURE-----

We believe that the bug you reported is fixed in the latest version of
binwalk, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1136010@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sven Geuer <sge@debian.org> (supplier of updated binwalk package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 26 Aug 2026 19:06:33 +0200
Source: binwalk
Architecture: source
Version: 2.4.3+dfsg1-2+deb13u1
Distribution: trixie
Urgency: medium
Maintainer: Debian Security Tools <team+pkg-security@tracker.debian.org>
Changed-By: Sven Geuer <sge@debian.org>
Closes: 1136010
Changes:
 binwalk (2.4.3+dfsg1-2+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * d/p/*: Add prevent-path-traversal-in-wince.patch fixing CVE-2026-7179;
     thanks to Fukui Daichi for providing the patch (Closes: #1136010).
Checksums-Sha1:
 71661eb226cd1996ca53039e48b94fd3c127e4d3 2253 binwalk_2.4.3+dfsg1-2+deb13u1.dsc
 bdeeaa042a1949e5d012071f547d9148ee74e95e 8748 binwalk_2.4.3+dfsg1-2+deb13u1.debian.tar.xz
 52ba464bec46b51cca2ed89ddf71ec4bd031009d 7206 binwalk_2.4.3+dfsg1-2+deb13u1_amd64.buildinfo
Checksums-Sha256:
 697888dfd81bdb880c9237e7de77cf1bef85b8f7806f5963a3ef2cc489f5f0e5 2253 binwalk_2.4.3+dfsg1-2+deb13u1.dsc
 fd8ebfd6abe255d4c4c3d662eab0106c6abf05635bc2e23e5575e5edb445f836 8748 binwalk_2.4.3+dfsg1-2+deb13u1.debian.tar.xz
 def2951e944904c622abb4eb20765e257c7e791a684b33f91b536a99ae9f8ecb 7206 binwalk_2.4.3+dfsg1-2+deb13u1_amd64.buildinfo
Files:
 37568c6f2f074fdfe00a5e765569ae6f 2253 devel optional binwalk_2.4.3+dfsg1-2+deb13u1.dsc
 11911b49ee669f88dc7b40a2add8b310 8748 devel optional binwalk_2.4.3+dfsg1-2+deb13u1.debian.tar.xz
 ee7742b57428b8154523d7d28364840d 7206 devel optional binwalk_2.4.3+dfsg1-2+deb13u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJDBAEBCgAtFiEEPfXoqkP8n9/QhvGVrfUO2vit1YUFAmqa8i8PHHNnZUBkZWJp
YW4ub3JnAAoJEK31Dtr4rdWFg6MP/R9Ev2+p0wegyLJGi6oFHn4YpzyXxPhHXebU
36NhiTFs5mcz8Ac4rsrCsDfUJS0PX+M9AEf+K2sd/O28c2KMML7Wh0WPsHTalVeV
V4F2wtUD7nfu9PZSJ+6T1mYshej2/tVs76JJgzPZuFPycgbzRpuQASxQCE+mjbMo
3wy87YRq95ZjydJV2AbPsoQ5+t2m4Gg7Cau/fv9Ofq/TauCCXtDT2YSw40Cj2o4G
R77YA20lxd0Fb4kTyrBoZJ8gkHJ+xFiaC+K1sJlURhzqMibG5sLO6soLWmNFgRQa
7ilvl6sZlDOZRNypYduFLAvElbW3MNcl1OBLvA95rV6728KzAd5gddxlcQLTAeHt
UWY5fmxMoT+ivO2EJG0bY/5MWqA/1L7lYcpy1HakvIhgE9ieMrvKSC3uKZfr6LoU
kR4J/10PXkxRQTiBXWQ31Wl7dfRtYrUa33oBuaQjDiwzMAasOaSrJ2ejPfrK84yz
BTpfz8TChN+lg/AhSSg4LNwEEcA1zwL/yVMS8BoueCzwH9RLWX5tQ7vlhM7+/Nym
1G4iJOjTaFQa4QyfbK79qFaL49Qe9bb9pWFxMux+bXoehX4vH7CRL9lvszGN8f4h
A97vIY+62JxWgixIHK85QaXD7iYiQjyKlxWocnR2w4j3ZeqF1gFGZ3ijDfERiCGA
1FXsRy4z
=C7DB
-----END PGP SIGNATURE-----