{"id":"CVE-2022-4510","state":"PUBLISHED","title":"Path Traversal in binwalk","description":"A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction, would extract a malicious binwalk module into the folder .config/binwalk/plugins.\n This vulnerability is associated with program files src/binwalk/plugins/unpfs.py.\n\nThis issue affects binwalk from 2.1.2b through 2.3.3 included.","publishedAt":"2023-01-25T12:25:14.811Z","updatedAt":"2025-12-16T09:06:07.670Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"ONEKEY"},"assigner":"ONEKEY","products":["Refirm Labs binwalk"],"affected":[{"vendor":"Refirm Labs","product":"binwalk","packageName":"binwalk","defaultStatus":"unaffected","versions":[{"version":"2.1.2b","status":"affected","lessThanOrEqual":"2.3.3","versionType":"2.1.2b"}],"modules":["PFS extractor"],"platforms":["Linux","MacOS"],"programFiles":["https://github.com/ReFirmLabs/binwalk/blob/11a9bcd4451c4e5ff5db5abbc0df06e7b8838568/src/binwalk/plugins/unpfs.py"],"repo":"https://github.com/ReFirmLabs/binwalk/"}],"references":["https://github.com/ReFirmLabs/binwalk/pull/617","https://security.gentoo.org/glsa/202309-07","https://lists.debian.org/debian-lts-announce/2025/12/msg00022.html"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T20:05:26.763Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/4xxx/CVE-2022-4510.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-4510","state":"PUBLISHED","datePublished":"2023-01-25T12:25:14.811Z","dateUpdated":"2025-12-16T09:06:07.670Z","assignerShortName":"ONEKEY","assignerOrgId":"2d533b80-6e4a-4e20-93e2-171235122846","dateReserved":"2022-12-15T08:12:09.055Z"},"containers":{"cna":{"title":"Path Traversal in binwalk","descriptions":[{"lang":"en","value":"A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction, would extract a malicious binwalk module into the folder .config/binwalk/plugins.\n This vulnerability is associated with program files src/binwalk/plugins/unpfs.py.\n\nThis issue affects binwalk from 2.1.2b through 2.3.3 included."}],"affected":[{"vendor":"Refirm Labs","product":"binwalk","packageName":"binwalk","defaultStatus":"unaffected","versions":[{"version":"2.1.2b","status":"affected","lessThanOrEqual":"2.3.3","versionType":"2.1.2b"}],"modules":["PFS extractor"],"platforms":["Linux","MacOS"],"programFiles":["https://github.com/ReFirmLabs/binwalk/blob/11a9bcd4451c4e5ff5db5abbc0df06e7b8838568/src/binwalk/plugins/unpfs.py"],"repo":"https://github.com/ReFirmLabs/binwalk/"}],"references":[{"url":"https://github.com/ReFirmLabs/binwalk/pull/617"},{"url":"https://security.gentoo.org/glsa/202309-07"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"ONEKEY","orgId":"2d533b80-6e4a-4e20-93e2-171235122846","dateUpdated":"2023-09-17T08:07:04.222Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Quentin Kaiser from ONEKEY Research Labs"}],"datePublic":"2023-01-26T09:00:00.000Z","exploits":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The finder provided a proof-of-concept publicly so that maintainers could reproduce the vulnerability (see <a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/ReFirmLabs/binwalk/pull/617\">https://github.com/ReFirmLabs/binwalk/pull/617</a>)."}],"value":"The finder provided a proof-of-concept publicly so that maintainers could reproduce the vulnerability (see  https://github.com/ReFirmLabs/binwalk/pull/617 https://github.com/ReFirmLabs/binwalk/pull/617 )."}],"impacts":[{"capecId":"CAPEC-549","descriptions":[{"lang":"en","value":"CAPEC-549 Local Execution of Code"}]},{"capecId":"CAPEC-126","descriptions":[{"lang":"en","value":"CAPEC-126 Path Traversal"}]}],"source":{"discovery":"EXTERNAL"},"timeline":[{"lang":"en","time":"2022-10-26T07:51:00.000Z","value":"Reported to binwalk maintainers with a pull request containing the fix (https://github.com/ReFirmLabs/binwalk/pull/617)"},{"lang":"en","time":"2023-01-23T08:00:00.000Z","value":"Reported to MSRC since they acquired Refirm Labs and we've observed the CPE 'microsoft:binwalk' for CVE-2021-4287"},{"lang":"en","time":"2023-01-25T08:00:00.000Z","value":"MSRC answers they do not consider binwalk a Microsoft product."}],"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The following workaround would fix the vulnerability:<br><ul><li>removing the unpfs extractor from your local install of binwalk</li><li>disabling the unpfs extractor by editing binwalk's extract.conf configuration file</li><li>apply the fix provided at&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/ReFirmLabs/binwalk/pull/617\">https://github.com/ReFirmLabs/binwalk/pull/617</a></li></ul>"}],"value":"The following workaround would fix the vulnerability:\n  *  removing the unpfs extractor from your local install of binwalk\n  *  disabling the unpfs extractor by editing binwalk's extract.conf configuration file\n  *  apply the fix provided at  https://github.com/ReFirmLabs/binwalk/pull/617 https://github.com/ReFirmLabs/binwalk/pull/617"}],"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://github.com/ReFirmLabs/binwalk/pull/617","tags":["x_transferred"]},{"url":"https://security.gentoo.org/glsa/202309-07","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/12/msg00022.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-12-16T09:06:07.670Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-03-27T19:54:52.860514Z","id":"CVE-2022-4510","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-27T19:55:06.184Z"}}]}}}