EIP-2026-103085

This is a writeup describing a directory traversal vulnerability in BusyBox's httpd daemon. The vulnerability allows an attacker to retrieve arbitrary files by manipulating the URL path with encoded dot-dot-slash sequences.