CVE-2021-4287

A vulnerability, which was classified as problematic, was found in ReFirm Labs binwalk up to 2.3.2. Affected is an unknown function of the file src/binwalk/modules/extractor.py of the component Archive Extraction Handler. The manipulation leads to symlink following. It is possible to launch the attack remotely. Upgrading to version 2.3.3 is able to address this issue. The name of the patch is fa0c0bd59b8588814756942fe4cb5452e76c1dcd. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216876.

• CWE-61
• CWE-59

• https://github.com/ReFirmLabs/binwalk/commit/fa0c0bd59b8588814756942fe4cb5452e76c1dcdPatch, Third Party Advisory
• https://github.com/ReFirmLabs/binwalk/pull/556Patch, Third Party Advisory
• https://github.com/ReFirmLabs/binwalk/releases/tag/v2.3.3Release Notes, Third Party Advisory
• https://vuldb.com/?ctiid.216876Third Party Advisory
• https://vuldb.com/?id.216876Third Party Advisory
• https://github.com/ReFirmLabs/binwalk/commit/fa0c0bd59b8588814756942fe4cb5452e76c1dcdPatch, Third Party Advisory
• https://github.com/ReFirmLabs/binwalk/pull/556Patch, Third Party Advisory
• https://github.com/ReFirmLabs/binwalk/releases/tag/v2.3.3Release Notes, Third Party Advisory
• https://vuldb.com/?ctiid.216876Third Party Advisory
• https://vuldb.com/?id.216876Third Party Advisory

Published

Dec 27, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-42860A stack buffer overflow exists in Mini-XML v3.2. When inputt…7.5
• CVE-2021-42863A buffer overflow in ecma_builtin_typedarray_prototype_filte…9.8
• CVE-2021-42866A Cross Site Scripting vulnerabilty exists in Pixelimity 1.0…4.8
• CVE-2021-42867A Cross Site Scripting (XSS) vulnerability exists in DanPros…4.8
• CVE-2021-42868A Cross Site Scripting (XSS) vulnerability exists in Chikist…4.8
• CVE-2021-42869A Cross Site Scripting (XSS) vulnerability exists in Chikist…4.8
• CVE-2021-42870ACCEL-PPP 1.12.0 has an out-of-bounds read in post_msg when …7.5
• CVE-2021-42872TOTOLINK EX1200T V4.1.2cu.5215 is affected by a command inje…9.8
• CVE-2021-42875TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command inj…9.8
• CVE-2021-42877TOTOLINK EX1200T V4.1.2cu.5215 contains a denial of service …7.5
• CVE-2021-4288A vulnerability was found in OpenMRS openmrs-module-referenc…6.1
• CVE-2021-42884TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command inj…9.8