CVE-2026-26158: Busybox: busybox: arbitrary file modification and privilege escalation via unvalidated tar archive entries
A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.
Other sources
Affects: BusyBox v1.36.1 and v1.37.0 (likely affects earlier versions too) CVSS: 9.3 (CRITICAL) Component: dataextractall.c in tar extraction - hardlink and symlink handling
Description: Hardlink entries in tar archives are created without validation of the linktarget path. This allows modification of files outside the extraction directory and bypasses existing path traversal mitigations. This vulnerability has higher impact than the path traversal issue as it does not rely on relative paths or the current working directory.
Technical Details: - Hardlink entries can point to absolute paths like /etc/passwd - Symlink entries suffer from the same root cause (missing linktarget validation) - When extraction is performed with elevated privileges, attackers can modify critical system files
Impact: Arbitrary file modification outside extraction directory, privilege escalation when combined with elevated extraction permissions, bypass of path traversal protections.
Note: While hardlinks and symlinks share the same root cause (missing linktarget validation), I'm requesting a single CVE for this issue.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26158?
CVE-2026-26158 has a high severity rating due to its potential for privilege escalation and arbitrary file modification.
How do I fix CVE-2026-26158?
To mitigate CVE-2026-26158, you should upgrade BusyBox to version 1.37.0 or later.
What versions of BusyBox are affected by CVE-2026-26158?
CVE-2026-26158 affects BusyBox versions between 1.36.1 and 1.37.0.
What kind of attacks can CVE-2026-26158 enable?
CVE-2026-26158 can enable an attacker to create a malicious tar archive that modifies files outside the intended extraction directory.
Which product is impacted by CVE-2026-26158?
The impacted product of CVE-2026-26158 is BusyBox.