Binwalk
Monthly
Path traversal in OSPG binwalk 2.4.3 and earlier allows local low-privileged attackers to read or write files outside the intended extraction directory by supplying a crafted WinCE firmware image that manipulates the `self.file_name` argument in the `read_null_terminated_string` function of the WinCE Extraction Plugin. A public proof-of-concept exploit exists, though EPSS sits at 0.01% (2nd percentile) and CISA KEV lists no confirmed active exploitation, indicating negligible real-world uptake. The project maintainer has acknowledged the flaw but confirmed no patch will be released, as binwalk 2.x is end-of-life; migration to binwalk v3 is the only vendor-endorsed resolution.
Path traversal in OSPG binwalk 2.4.3 and earlier allows local low-privileged attackers to read or write files outside the intended extraction directory by supplying a crafted WinCE firmware image that manipulates the `self.file_name` argument in the `read_null_terminated_string` function of the WinCE Extraction Plugin. A public proof-of-concept exploit exists, though EPSS sits at 0.01% (2nd percentile) and CISA KEV lists no confirmed active exploitation, indicating negligible real-world uptake. The project maintainer has acknowledged the flaw but confirmed no patch will be released, as binwalk 2.x is end-of-life; migration to binwalk v3 is the only vendor-endorsed resolution.