OSPG binwalk up to 2.4.3 WinCE Extraction Plugin winceextract.py read_null_terminated_string self.file_name path traversal

Summaryinfo

A vulnerability identified as critical has been detected in OSPG binwalk up to 2.4.3. This issue affects the function read_null_terminated_string of the file src/binwalk/plugins/winceextract.py of the component WinCE Extraction Plugin. Performing a manipulation of the argument self.file_name results in path traversal. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is identified as CVE-2026-7179. The attack is only possible with local access. Additionally, an exploit exists. The project maintainer confirms this issue: "I accept the existence of the Path Traversal vulnerability. However, as stated in the Github link, it reached EOL and as a result no actions should be expected." The GitHub repository mentions, that "[u]sers and contributors should migrate to binwalk v3."

Detailsinfo

A vulnerability was found in OSPG binwalk up to 2.4.3. It has been classified as critical. This affects the function read_null_terminated_string of the file src/binwalk/plugins/winceextract.py of the component WinCE Extraction Plugin. The manipulation of the argument self.file_name with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality, integrity, and availability.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-7179. The exploitability is told to be easy. An attack has to be approached locally. Technical details and a public exploit are known. MITRE ATT&CK project uses the attack technique T1006 for this issue.

The exploit is shared for download at github.com. It is declared as proof-of-concept. The project maintainer confirms this issue: "I accept the existence of the Path Traversal vulnerability. However, as stated in the Github link, it reached EOL and as a result no actions should be expected." The GitHub repository mentions, that "[u]sers and contributors should migrate to binwalk v3." The vulnerability scanner Nessus provides a plugin with the ID 311016 (Linux Distros Unpatched Vulnerability : CVE-2026-7179), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (311016) and EUVD (EUVD-2026-25932). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• OSPG

Name

• binwalk

Version

• 2.4.0
• 2.4.1
• 2.4.2
• 2.4.3

Support

• end of life

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #802228: OSPG binwalk (Python version) <= 2.4.3 Path Traversal (by dhabaleshwar)

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion