# Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host

Boxlite OCI layer extractor creates symlinks with unvalidated absolute targets, letting a malicious image write arbitrary host files as root.

- Payout: Research
- Severity: critical
- Program: Boxlite
- Found by: XlabAITeam, keenanwgn, A7um
- Disclosed: 2026-05-21
- CVE: CVE-2026-46703
- Write-up quality: 8/10
- Original: https://github.com/advisories/GHSA-f396-4rp4-7v2j
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-f396-4rp4-7v2j
- Tags: area:cloud domain:infra impact:integrity impact:rce kind:research platform:ghsa sev:critical tech:docker tech:rust technique:source-review vuln:path-traversal vuln:rce

**Target:** OCI image layer tar extraction in boxlite sandbox service
**Root cause:** apply_oci_layer sanitizes the symlink's own path but never validates the symlink target, and ensure_parent_dirs deliberately preserves symlinks pointing outside dest as valid parents; create_regular_file then opens through them, following the escape.
**Steps:**
1. Craft OCI layer tar with entries in order: `SYMLINK escape -> /tmp`, `DIR escape/boxlite_host_escape`, `FILE escape/boxlite_host_escape/pwned.txt` with attacker payload
2. Build valid OCI layout (blobs/sha256, index.json, oci-layout) with matching digests so manifest verification passes
3. Load image via `boxlite.SimpleBox(rootfs_path=OCI_LAYOUT_DIR)`
4. Extraction runs in host process before VM start; `ensure_parent_dirs` sees `{dest}/escape` is a symlink to a directory and breaks to preserve it
5. `create_regular_file` opens `{dest}/escape/boxlite_host_escape/pwned.txt`, kernel resolves through symlink to `/tmp/boxlite_host_escape/pwned.txt` and writes payload
6. Verify host file exists outside extraction root
**How found:** Code review of tar extraction: noticed symlink target never validated while link path was normalized, and that ensure_parent_dirs explicitly breaks to preserve out-of-root directory symlinks, then confirmed OpenOptions::open follows symlinks.
**Exploitation:** Attacker publishes malicious OCI image on DockerHub; victim pulls/loads it. During host-side layer extraction, symlink escape yields arbitrary file write at process privilege (commonly root), e.g. appending a public key to /etc/authorized_keys for host RCE.
**Escalation:** Arbitrary host file write as root escalates to host RCE via authorized_keys or similar persistence files.
**Insight:** In tar/zip extractors, audit the symlink target separately from the entry path, and check whether parent-dir creation logic special-cases symlinks-to-directories — that 'preserve' branch is exactly where escapes survive.

## Proof of concept (copied exactly from the original report)

**Malicious tar entries: symlink escape then file write**

```
add_entry(tf, "escape", tarfile.SYMTYPE, linkname="/tmp", mode=0o777)
           add_entry(tf, "escape/boxlite_host_escape", tarfile.DIRTYPE, mode=0o755)
           add_entry(
               tf, "escape/boxlite_host_escape/pwned.txt", tarfile.REGTYPE, data=payload
           )
           add_entry(
               tf,
               "etc/os-release",
               tarfile.REGTYPE,
               data=b"ID=alpine\nVERSION_ID=3.19.0\n",
           )
```