MEDIUMCVSS v3.1 5.3Vulnerability
CVE-2026-124738
A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this flaw by requesting an uncompressed file path while specifying gzip encoding, bypassing password rules configured specifically for the compressed file. This vulnerability can lead to unauthorized information disclosure of sensitive files.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-11T23:49:45.533241+00:00
- Cvss score
- 5.3
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-11-11T23:50:18+00:00
- Score
- 5.3
- Last source
- NVD
- Cvss version
- 3.1
- Cve id
- CVE-2026-124738
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- First seen by Signal
- 2026-11-11T15:41:39+00:00
- Name
- CVE-2026-124738
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Published at
- 2026-11-11T12:19:47.537
- Last modified
- 2026-11-11T12:19:47.673
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph