---
id: CVE-2022-4510
aliases:
  - GHSA-3cm8-v4mc-gppg
  - PYSEC-2026-787
title: Path traversal in binwalk
summary: Path traversal in binwalk
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
vendor: binwalk
product: binwalk
ecosystem: pip
affected:
  - 'binwalk >= 2.1.2b, <= 2.3.3'
published: '2023-01-26'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-3cm8-v4mc-gppg'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-4510'
  - url: 'https://github.com/ReFirmLabs/binwalk/pull/617'
  - url: 'https://github.com/ReFirmLabs/binwalk'
  - url: 'https://lists.debian.org/debian-lts-announce/2025/12/msg00022.html'
  - url: 'https://security.gentoo.org/glsa/202309-07'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.22013
epssPercentile: 0.97553
exploitAvailable: true
ingestedAt: '2026-07-08T18:25:44.893Z'
exploits:
  exploitdb: true
  github: 3
  githubRepos:
    - 'https://github.com/electr0sm0g/CVE-2022-4510'
    - 'https://github.com/adhikara13/CVE-2022-4510-WalkingPath'
    - 'https://github.com/Kalagious/BadPfs-CVE-2022-4510'
  checkedAt: '2026-09-23T07:13:24.478Z'
---

## Overview

A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 inclusive. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction, would extract a malicious binwalk module into the folder .config/binwalk/plugins. This vulnerability is associated with program files src/binwalk/plugins/unpfs.py. This issue affects binwalk from 2.1.2b through and including 2.3.3.

## Affected packages

- `binwalk >= 2.1.2b, <= 2.3.3`

## Remediation

Refer to the advisory for the patched release.