Arbitrary file truncation in busybox patch binary

[mjmouse9999 at gmail.com]

> From: busybox <busybox-bounces at busybox.net> On Behalf Of Arthur Chan via busybox
> Sent: Tuesday, 14 April 2026 07:59
>
> Hi,
>
> I am writing to report an arbitrary file truncation in busybox project and
> specifically in the patch binary when processing a malicious patch file could
> truncate or create arbitrary file in the file system with the user privilege.
>
> It is triggerable through the `busybox patch` when the system manager or cornjob
> applys regular patches which include a malicious patch file. It will result in
> arbitrary file truncation or creation through direct path traversal that may
> affect important system file with the user privilege.
>
> I have attached a markdown arbitrary_file_truncation.md that holds detail
> descriptions and reproduction steps of the vulnerability.
>
> This issue was found by Anthropic from using agents to study security of open
> source projects, and I am from Ada Logics helping validate the found issues and
> report to maintainers. The data in this email has been reviewed manually.
>
> Please let me know if you have any questions!
>
> Kind regards,
> Arthur Chan
>
> ADA Logics Ltd is registered in England. No: 11624074.
> Registered office: 266 Banbury Road, Post Box 292, 
> OX2 7DL, Oxford, Oxfordshire , United Kingdom 

Hello Arthur,

So there are three relevant things, two of which your report notes:

1. A patch deleting or truncating a file does not check that the contents match
   the patch hunk. (which makes it no longer reversible)

2. A patch is happy to patch absolute paths with -p0, including when the
   current directory is not the root directory.

3. And a patch is happy to patch paths with `/../` as an element. (That seems
   to have been missed in this ticket, but is noted in the original CVE against
   GNU patch)

And also the original CVE link from your attachment for reference:
https://nvd.nist.gov/vuln/detail/CVE-2010-4651

Regards,
Morgan