UBUNTU-CVE-2026-124745: Medium severity ubuntu/busybox vulnerability
A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links pointing outside the intended extraction directory. An attacker could provide a specially crafted archive that links to sensitive files outside the extraction tree, allowing subsequent extraction operations to overwrite arbitrary files on the system.
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to do to exploit this issue?
The attacker must be able to supply a specially crafted archive that is extracted with the BusyBox tar utility.
Which extraction workflows are most exposed?
Workflows that use BusyBox tar to extract archives from untrusted sources are exposed, particularly where later extraction operations can write files after a deferred hardlink resolves through a symbolic link outside the intended extraction directory.