GHSA-f396-4rp4-7v2j: Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host

Summary

Boxlite, a sandbox service that runs OCI containers inside lightweight virtual machines, does not validate symlink targets when extracting tar entries from OCI image layers. An attacker can publish a crafted image to registries such as DockerHub, and once a user loads it, the attacker can write arbitrary content to any host path, which can lead to remote code execution on the host. The flaw sits in extract_layer_tarball_streaming and apply_oci_layer in boxlite/src/images/archive/tar.rs, and ensure_parent_dirs deliberately preserves symlinks that escape the extraction root.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• MediumCVE-2026-100653: vLLM unpinned Hugging Face artifact loads for FunAudioChat and Tarsier2Same vendor · NVD/CVE Database
• HighGHSA-3hmm-rh5q-gwwr: LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loadingSame vendor · Hugging Face Security Advisories
• MediumCVE-2026-80047: Hugging Face Transformers writes remote Python files to disk before trust checkSame vendor · NVD/CVE Database
• HighCVE-2026-58474: whichllm code injection in run and snippet commands via GGUF filenamesSame vendor · NVD/CVE Database
• HighCVE-2026-79784: Vocos class instantiation from configuration via from_pretrainedSame vendor · NVD/CVE Database