CVSS 3.1
7.8 highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2022-4510
High (7.8) in microsoft binwalk. EPSS 22% chance of exploitation in the next 30 days. Fixed in binwalk 2.3.4.
A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction, would extract a malicious binwalk module into the folder .config/binwalk/plugins.
This vulnerability is associated with program files src/binwalk/plugins/unpfs.py.
This issue affects binwalk from 2.1.2b through 2.3.3 included.
Severity
- EPSS
- 22% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- microsoft:binwalk
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3cm8-v4mc-gppg | PyPI | binwalk | >=2.1.2b <=2.3.3 | no fix published |
| PYSEC-2026-787 | PyPI | binwalk | >=2.1.2b <2.3.4 | 2.3.4 |