CVE-2026-26158
published 2026-02-11CVE-2026-26158: A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar…
PriorityP434high7CVSS 3.1
AVLACHPRNUIRSUCHIHAH
EPSS
0.19%
8.8th percentile
A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| busybox | busybox | — | — |
| busybox | busybox | >= 0 < 1:1.37.0-10.1 | 1:1.37.0-10.1 |
| debian | busybox | < busybox 1:1.37.0-10.1 (forky) | busybox 1:1.37.0-10.1 (forky) |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
osv7.0HIGH
vendor_debian7.0HIGH
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
BusyBox TAR Archive file inclusion (Nessus ID 298799)
vuldb·2026-05-06·CVSS 7.0
CVE-2026-26158 [HIGH] BusyBox TAR Archive file inclusion (Nessus ID 298799)
A vulnerability classified as problematic has been found in BusyBox. Impacted is an unknown function of the component TAR Archive Handler. Performing a manipulation results in file inclusion.
This vulnerability was named CVE-2026-26158. The attack may be initiated remotely. There is no available exploit.
To fix this issue, it is recommended to deploy a patch.
GHSA
GHSA-r8f8-4pgh-4m8v: A flaw was found in BusyBox
ghsa_unreviewed·2026-02-11
CVE-2026-26158 [HIGH] CWE-73 GHSA-r8f8-4pgh-4m8v: A flaw was found in BusyBox
A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.
OSV
CVE-2026-26158: A flaw was found in BusyBox
osv·2026-02-11·CVSS 7.0
CVE-2026-26158 [HIGH] CVE-2026-26158: A flaw was found in BusyBox
A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.
Red Hat
busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses CVE-2026-26158 fix
vendor_redhat·2026-10-09·CVSS 6.3
CVE-2026-108119 [MEDIUM] CWE-59 busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses CVE-2026-26158 fix
busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses CVE-2026-26158 fix
A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive using a symlink target of exactly '..' combined with a deferred hardlink to create a new file outside the extraction directory, or reuse an extraction directory across two archives to replace an existing file outside it. If the archive is extracted with elevated privileges, this flaw can lead to privilege escalation or arbitrary code execution.
Statement: This vulnerability is rated as
Red Hat
busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries
vendor_redhat·2026-02-11·CVSS 7.0
CVE-2026-26158 [HIGH] CWE-73 busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries
busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries
A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.
A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to pr
Debian
CVE-2026-26158: busybox - A flaw was found in BusyBox. This vulnerability allows an attacker to modify fil...
vendor_debian·2026·CVSS 7.0
CVE-2026-26158 [HIGH] CVE-2026-26158: busybox - A flaw was found in BusyBox. This vulnerability allows an attacker to modify fil...
A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 1:1.37.0-10.1)
sid: resolved (fixed in 1:1.37.0-10.1)
trixie: open
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-108119 busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses CVE-2026-26158 fix [epel-all]
bugzilla·2026-10-09·CVSS 6.3
CVE-2026-108119 [MEDIUM] CVE-2026-108119 busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses CVE-2026-26158 fix [epel-all]
CVE-2026-108119 busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses CVE-2026-26158 fix [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in busybox. The tar applet defers creation of symlink and hardlink entries whose targets look unsafe (absolute paths, hardlinks, or targets containing '..') until after all archive members have been processed, in order to avoid a same-archive time-of-check-to-time-of-use issue. However, when those deferred links are finally created, the code performs the underlying symlink() or link() system call directly, without
Bugzilla
CVE-2026-108119 busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses CVE-2026-26158 fix
bugzilla·2026-10-09·CVSS 6.3
CVE-2026-108119 [MEDIUM] CVE-2026-108119 busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses CVE-2026-26158 fix
CVE-2026-108119 busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses CVE-2026-26158 fix
A flaw was found in busybox. The tar applet defers creation of symlink and hardlink entries whose targets look unsafe (absolute paths, hardlinks, or targets containing '..') until after all archive members have been processed, in order to avoid a same-archive time-of-check-to-time-of-use issue. However, when those deferred links are finally created, the code performs the underlying symlink() or link() system call directly, without re-validating that the resolved destination parent remains inside the extraction directory. By chaining an immediately-created symlink with a deferred symlink whose target is exactly '..' (a value not caught by the separate prefix-based
Bugzilla
CVE-2026-108119 busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses CVE-2026-26158 fix [fedora-all]
bugzilla·2026-10-09·CVSS 6.3
CVE-2026-108119 [MEDIUM] CVE-2026-108119 busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses CVE-2026-26158 fix [fedora-all]
CVE-2026-108119 busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses CVE-2026-26158 fix [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in busybox. The tar applet defers creation of symlink and hardlink entries whose targets look unsafe (absolute paths, hardlinks, or targets containing '..') until after all archive members have been processed, in order to avoid a same-archive time-of-check-to-time-of-use issue. However, when those deferred links are finally created, the code performs the underlying symlink() or link() system call directly, withou
Bugzilla
CVE-2026-26158 busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries [fedora-42]
bugzilla·2026-02-11·CVSS 7.0
CVE-2026-26158 [HIGH] CVE-2026-26158 busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries [fedora-42]
CVE-2026-26158 busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.
Package Maintainer: If you wish for this bug to remain open because you
plan to fix i
Bugzilla
CVE-2026-26158 busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries
bugzilla·2026-02-11·CVSS 7.0
CVE-2026-26158 [HIGH] CVE-2026-26158 busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries
CVE-2026-26158 busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries
Affects: BusyBox v1.36.1 and v1.37.0 (likely affects earlier versions too)
CVSS: 9.3 (CRITICAL)
Component: data_extract_all.c in tar extraction - hardlink and symlink
handling
Description:
Hardlink entries in tar archives are created without validation of the
link_target path. This allows modification of files outside the extraction
directory and bypasses existing path traversal mitigations. This
vulnerability has higher impact than the path traversal issue as it does
not rely on relative paths or the current working directory.
Technical Details:
- Hardlink entries can point to absolute paths like /etc/passwd
- Symlink entries suffer from the same root cause (missing
Rapid7
Patch Tuesday - October 2026
blogs_rapid7·2026-10-13·CVSS 8.8
CVE-2026-96951 [HIGH] Patch Tuesday - October 2026
Microsoft is publishing 1,413 own-product vulnerabilities on October 2026 Patch Tuesday , including 1,102 vulnerabilities in Windows. Anyone who enjoyed last month’s record-setting Patch Tuesday will love the October 2026 edition, because it’s much bigger still. As Rapid7 has noted over the course of 2026, there is every reason to suppose that vulnerability volumes will continue to rise. Microsoft is aware of exploitation in the wild for just one of the vulnerabilities published today, as well as public disclosure for two others.
## Windows Shell: zero-day security feature bypass
The Windows Shell is Microsoft’s term for the GUI interaction logic for the entire OS provided by explorer.exe and associated libraries and APIs, and for the second time this year , the Windows Shell is the site
Wiz
CVE-2026-26158 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.8
CVE-2026-26158 [HIGH] CVE-2026-26158 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-26158 :
CBL Mariner vulnerability analysis and mitigation
A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.
Source : NVD
## 7
Score
Published February 11, 2026
Severity HIGH
CNA Score 7.0
Affected Technologies
CBL Mariner
Linux Debian
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.2
Exploitation Probability (EPSS) N/A
Affected pac
https://access.redhat.com/errata/RHSA-2026:13831https://access.redhat.com/security/cve/CVE-2026-26158https://bugzilla.redhat.com/show_bug.cgi?id=2439040https://git.busybox.net/busybox/commit/archival?id=3fb6b31c716669e12f75a2accd31bb7685b1a1cbhttps://access.redhat.com/errata/RHSA-2026:13831https://access.redhat.com/security/cve/CVE-2026-26158https://bugzilla.redhat.com/show_bug.cgi?id=2439040https://cert-portal.siemens.com/productcert/html/ssa-253495.htmlhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26158.json
2026-02-11
Published