CVE-2025-46394

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-46394
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-46394.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-46394
Downstream
ALPINE (1)
AZL (2)
BELL (1)
CGA (4)
CLEANSTART (5)
DEBIAN (1)
ECHO (1)
MINI (1)
OESA (6)
openSUSE (2)
SUSE (5)
UBUNTU (1)
Related
openSUSE (2)
SUSE (5)
Published
2025-04-23T16:15:48Z
Modified
2026-07-17T20:58:19Z
Severity
  • 3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.

References

Affected packages

Git /

Affected ranges

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-46394.json"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.37.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.37.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "the"
            }
        ]
    }
]