CVE-2026-7179: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-7179 is a path traversal vulnerability in the WinCE Extraction Plugin of OSPG binwalk versions up to and including 2.4.3. The flaw resides in the read_null_terminated_string() function within src/binwalk/plugins/winceextract.py, where unsanitized filenames embedded in crafted WinCE ROM images are used to construct output file paths, enabling arbitrary file writes outside the intended extraction directory. The vulnerability was discovered on April 9, 2026, by Dhabaleshwar Das and publicly disclosed on April 27, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 4.8 (Medium) (GitHub Advisory, Feedly). The project maintainer has acknowledged the vulnerability but confirmed no patch will be issued, as binwalk 2.x has reached end-of-life (EOL).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), arising from the complete absence of path sanitization in the data flow from read_null_terminated_string() (in winceextractor.py, lines 454–470) through self.file_name storage to the open(os.path.join(indir, file_name)) sink in winceextract.py (lines 61, 64). No os.path.basename(), startswith() boundary check, or any other sanitization is applied, allowing directory traversal sequences (e.g., ../../) embedded in WinCE ROM filenames to resolve to arbitrary filesystem locations (GitHub PoC). The attack vector is local and requires low privileges; exploitation is triggered when a user runs binwalk -e against a maliciously crafted firmware image. Notably, this vulnerability is distinct from CVE-2022-4510, which patched a similar issue in unpfs.py but left winceextract.py unaddressed (GitHub PoC). A public proof-of-concept shell script (binwalk_poc.sh) has been released alongside the disclosure.

Successful exploitation allows an attacker to write arbitrary files to any location accessible by the user running binwalk, including sensitive targets such as ~/.ssh/authorized_keys, /etc/cron.d/, or ~/.bashrc. Most critically, by writing a malicious Python file to ~/.config/binwalk/plugins/, an attacker can achieve Remote Code Execution (RCE) on the next binwalk invocation, since binwalk automatically loads and executes all .py files in that directory (GitHub PoC). Given that binwalk 2.4.3 is the default pre-installed version on Kali Linux and is widely used by security researchers, CTF participants, and automated firmware analysis pipelines, the practical impact extends to a large population of users who may analyze untrusted firmware images.

A public proof-of-concept (binwalk_poc.sh) has been disclosed alongside the CVE, demonstrating both the path traversal and the RCE-via-plugin-injection attack chain (GitHub PoC). The EPSS score is approximately 0.013% (0.02% per GitHub Advisory), placing it in the 6th percentile for exploitation probability within 30 days (GitHub Advisory). There is no evidence of in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA KEV catalog. The CVSS v4.0 exploit maturity is rated as Proof-of-Concept (Feedly).

1. Craft a malicious WinCE ROM image: Using a script (e.g., the published binwalk_poc.sh), construct a minimal WinCE ROM binary where a file entry's embedded filename contains directory traversal sequences, such as ../../../home/user/.config/binwalk/plugins/malicious.py or ../../../../../../etc/cron.d/backdoor.
2. Embed malicious payload: Populate the file content within the ROM with a Python script (for plugin injection RCE) or a cron job/SSH key (for persistence). For RCE, the Python file should contain code to execute arbitrary commands when imported.
3. Deliver the firmware image: Distribute the crafted firmware image to a target — for example, by hosting it as a firmware download, sharing it in a CTF context, or embedding it in a supply chain scenario where a researcher would analyze it.
4. Trigger extraction: The victim runs binwalk -e malicious_firmware.bin. The WinCE Extraction Plugin calls read_null_terminated_string(), reads the unsanitized filename, and writes the payload file to the traversed path outside the extraction directory (e.g., ~/.config/binwalk/plugins/malicious.py).
5. Achieve code execution: On the next invocation of binwalk by the victim, binwalk automatically loads all .py files from ~/.config/binwalk/plugins/, executing the attacker's planted plugin with the victim's privileges (GitHub PoC).

• File System: Unexpected .py files appearing in ~/.config/binwalk/plugins/ that were not manually placed by the user; files written outside the expected binwalk extraction directory (e.g., in ~/.ssh/, /etc/cron.d/, or ~/.bashrc) with timestamps correlating to a binwalk extraction run.
• Logs: Shell history or audit logs showing binwalk -e invocations against unfamiliar or externally sourced firmware files; file creation events (via auditd or inotifywait) in sensitive directories immediately following binwalk execution.
• Process: Unexpected processes spawned by binwalk's Python interpreter after a firmware extraction, particularly shells or network utilities (e.g., bash, curl, wget, python3) that are children of the binwalk process.
• Network: Outbound connections from the user's workstation to unknown external IPs shortly after a binwalk run, potentially indicating a reverse shell or data exfiltration payload executed via the injected plugin (GitHub PoC).

The project maintainer has confirmed that binwalk 2.x (all versions up to 2.4.3) has reached end-of-life and no patch will be released; the recommended remediation is to migrate to binwalk v3 (the Rust-based rewrite), which is not affected due to its centralized Chroot path sanitization architecture (GitHub PoC, GitHub Advisory). As an interim workaround where immediate migration is not possible, restrict local system access to trusted users only, apply the principle of least privilege, and avoid running binwalk against untrusted or externally sourced firmware images. Additionally, monitor ~/.config/binwalk/plugins/ for unexpected file additions and consider removing or restricting write access to that directory.

The project maintainer explicitly acknowledged the vulnerability via email, stating: "I accept the existence of the Path Traversal vulnerability. However, as stated in the Github link, it reached EOL and as a result no actions should be expected" (GitHub Advisory). The researcher (Dhabaleshwar Das) noted the disclosure challenge posed by the archived repository — no issue tracker, pull requests, or security advisories could be opened — and proceeded with public disclosure following the same approach used for the original CVE-2022-4510 (GitHub PoC). Red Hat tracked the issue via Bugzilla (Bug 2463312) with medium severity, and Tenable published a Nessus plugin (311016) for detection (Red Hat Bugzilla). A technical blog post by Payatu further analyzed the vulnerability, framing it as a path from firmware analysis to code execution.