CVE-2026-79655: Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write
A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root.
Other sources
Upstream issue: https://github.com/sosreport/sos/issues/4460 Proposed Fix: https://github.com/sosreport/sos/pull/4461 Component: sos (sos/cleaner/archives/init.py — extractarchive()) CWE: CWE-22 and CWE-59 Suggested CVSS 3.1: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8)
Summary: sos clean extracts a caller-supplied tarball with tarfile.fullytrustedfilter. A dest-containment check exists but only inspects member.name. It does not inspect symlink or hardlink targets. extractall() can therefore write files outside the extract directory as the process UID.
Description: A path traversal vulnerability was found in sos clean in the sos package. The extractarchive() function uses Python's tarfile module with fullytrustedfilter and validates only archive member names against the extraction directory. Symlink and hardlink targets are not validated. A crafted tar archive can therefore contain an out-of-tree symlink followed by a regular file whose apparent path remains within the extraction directory. During extraction, tarfile.extractall() follows the symlink and writes the file to an attacker-controlled location outside the extraction directory. This can result in arbitrary file creation or overwrite with the privileges of the sos clean process, which is commonly run as root.
Reporter / Credit: Sandipan Roy (Red Hat)
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
sos (sos/cleaner/archives/_init_.py — extract_archive())to a version that resolves this vulnerability.Patch https://github.com/sosreport/sos/pull/4461
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
Exploitation is local and does not require privileges, but the attacker must be able to cause sos clean to extract a crafted tar archive. User interaction is required before the malicious archive is processed.
What determines the impact on a particular system?
Files can be created or overwritten with the privileges of the sos clean process. The impact is especially severe where sos clean is run as root, because writes may reach arbitrary root-writable locations.
Which tar archive content bypasses the existing extraction safeguard?
The existing destination-containment check examines only the archive member name. Malicious symlink or hardlink targets are not validated, allowing extraction to escape the intended directory.