CVE-2026-124738

MediumCVSS 5.3/10Last modified Nov 12, 2026

Description

A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this flaw by requesting an uncompressed file path while specifying gzip encoding, bypassing password rules configured specifically for the compressed file. This vulnerability can lead to unauthorized information disclosure of sensitive files.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-288

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Hardened Images	—

References

Timeline

Published: Nov 11, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1247397.5A flaw was found in BusyBox. When the httpd web server processes subdirectory configuration files, an overly long index page name can trigge CVE-2026-1247404.3A flaw was found in BusyBox's udhcpc6 DHCPv6 client. A malicious server on the local network can trigger a use-after-free condition by respo CVE-2026-1247417.6A flaw was found in BusyBox. The udhcpc6 DHCPv6 client does not properly validate the size of network options sent by a server before copyin CVE-2026-1247425.5A flaw was found in BusyBox. The volume identification component fails to properly validate cluster parameters when analyzing specially form CVE-2026-1247435.5A flaw was found in BusyBox. When processing filesystem metadata, the volume identification component does not properly validate header valu CVE-2026-1247446.3A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are CVE-2026-1247456.3A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links CVE-2026-1247465.5A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer boundaries while probing filesyst CVE-2026-1247477.5A flaw was found in BusyBox. When resuming a download over File Transfer Protocol (FTP), the wget utility fails to verify that the resume of CVE-2026-1247526.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons CVE-2026-1247534.3Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Le CVE-2026-124767.2The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to