Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only vector with low-privilege requirement; partial CIA impact from path traversal enabling limited file read/write; no scope change beyond the vulnerable system.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
6DescriptionCVE.org
A security vulnerability has been detected in OSPG binwalk up to 2.4.3. This vulnerability affects the function read_null_terminated_string of the file src/binwalk/plugins/winceextract.py of the component WinCE Extraction Plugin. Such manipulation of the argument self.file_name leads to path traversal. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The project maintainer confirms this issue: "I accept the existence of the Path Traversal vulnerability. However, as stated in the Github link, it reached EOL and as a result no actions should be expected." The GitHub repository mentions, that "[u]sers and contributors should migrate to binwalk v3." This vulnerability only affects products that are no longer supported by the maintainer.
AnalysisAI
Path traversal in OSPG binwalk 2.4.3 and earlier allows local low-privileged attackers to read or write files outside the intended extraction directory by supplying a crafted WinCE firmware image that manipulates the self.file_name argument in the read_null_terminated_string function of the WinCE Extraction Plugin. A public proof-of-concept exploit exists, though EPSS sits at 0.01% (2nd percentile) and CISA KEV lists no confirmed active exploitation, indicating negligible real-world uptake. The project maintainer has acknowledged the flaw but confirmed no patch will be released, as binwalk 2.x is end-of-life; migration to binwalk v3 is the only vendor-endorsed resolution.
Technical ContextAI
binwalk is a firmware analysis and extraction tool commonly used in embedded-systems security research and reverse engineering. The vulnerable component is the WinCE Extraction Plugin located at src/binwalk/plugins/winceextract.py. The read_null_terminated_string function reads filenames from WinCE filesystem structures and passes the unsanitized self.file_name value directly to filesystem operations. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) describes this root cause: without normalization or boundary validation, attacker-controlled path components such as ../ sequences can redirect file operations outside the intended extraction root. The affected CPE is cpe:2.3:a:ospg:binwalk:*:*:*:*:*:*:*:*, covering all OSPG-maintained 2.x releases through 2.4.3.
RemediationAI
The only vendor-endorsed resolution is migration from binwalk 2.x to binwalk v3, as explicitly stated by the project maintainer following their EOL declaration - no vendor-released patch is identified at time of analysis for any 2.x release. If immediate migration is not feasible, a targeted compensating control is to remove or disable the WinCE Extraction Plugin (src/binwalk/plugins/winceextract.py) from the local binwalk installation, which eliminates the vulnerable code path at the cost of losing WinCE firmware extraction capability. Additionally, restrict execution of binwalk to trusted users only via filesystem permissions or sudoers policy, since the attack vector is strictly local and requires at least low-level privilege. Reference the VulDB advisory at https://vuldb.com/vuln/359781 and the POC at https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/binwalk_path_traversal.md for technical detail.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today