CVE-2026-7179

A security vulnerability has been detected in OSPG binwalk up to 2.4.3. This vulnerability affects the function read_null_terminated_string of the file src/binwalk/plugins/winceextract.py of the component WinCE Extraction Plugin. Such manipulation of the argument self.file_name leads to path traversal. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The project maintainer confirms this issue: "I accept the existence of the Path Traversal vulnerability. However, as stated in the Github link, it reached EOL and as a result no actions should be expected." The GitHub repository mentions, that "[u]sers and contributors should migrate to binwalk v3." This vulnerability only affects products that are no longer supported by the maintainer.

• CWE-22

• https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/binwalk_path_traversal.md
• https://vuldb.com/submit/802228
• https://vuldb.com/vuln/359781
• https://vuldb.com/vuln/359781/cti

Published

Apr 27, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7168Successfully using libcurl to do a transfer over a specific …5.3
• CVE-2026-7169a vulnerability involving an unchecked search path element i…7.5
• CVE-2026-71693Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
• CVE-2026-71694An issue in Berkeley Out-of-Order Machine (BOOM) / BoomTile …8.8
• CVE-2026-7177A security flaw has been discovered in ChatGPTNextWeb NextCh…7.3
• CVE-2026-7178A weakness has been identified in ChatGPTNextWeb NextChat up…7.3
• CVE-2026-71801An issue was discovered in s-pms SPMS-Server through v1.0. T…9.8
• CVE-2026-71802A stored Cross-Site Scripting (XSS) vulnerability exists in …5.4
• CVE-2026-71803money-pos 1.0 contains a stored Cross-Site Scripting (XSS) v…5.4
• CVE-2026-71805An arbitrary file upload and path traversal vulnerability ex…9.8
• CVE-2026-71807In RuoYi-Cloud-Plus <= 2.6.2 in the ruoyi-workflow module, m…4.3
• CVE-2026-71808A SQL Injection vulnerability in Siam Ordering (siam-server)…8.8