Hi,

The following vulnerability was published for busybox.

CVE-2026-92205[0]:
| BusyBox libarchive Symlink Directory Traversal Arbitrary File
| Creation Vulnerability. This vulnerability allows remote attackers
| to create arbitrary files on affected installations of BusyBox. User
| interaction is required to exploit this vulnerability in that the
| target must visit a malicious page or open a malicious file.  The
| specific flaw exists within the libarchive component. The issue
| results from the lack of proper validation of a user-supplied path
| prior to using it in file operations. An attacker can leverage this
| vulnerability to create files in the context of the current user.
| Was ZDI-CAN-27556.

https://www.zerodayinitiative.com/advisories/ZDI-26-705/


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-92205
https://www.cve.org/CVERecord?id=CVE-2026-92205

Please adjust the affected versions in the BTS as needed.