CVE-2025-46394

LOW

BusyBox < 1.37.0 - User Interface Misrepresentation of Filenames via Terminal Escape Sequences

Title source: llm

In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.

Core 6

Core References

Issue Tracking

Product

Product

Vendor Advisory

Mailing List

Mailing List

CVSS v3 3.2

EPSS 0.0014

EPSS Percentile 3.9%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

CWE

CWE-451

Status published

Products (2)

busybox/busybox < 1.37.0

BusyBox/BusyBox < 1.37.0

Published Apr 23, 2025

Tracked Since Feb 18, 2026