CVE-2026-26158
published 2026-02-11CVE-2026-26158: A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar…
PriorityP434high7CVSS 3.1
AVLACHPRNUIRSUCHIHAH
EPSS
0.16%
5.6th percentile
A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| busybox | busybox | >= 0 < 1:1.37.0-10.1 | 1:1.37.0-10.1 |
| debian | busybox | < busybox 1:1.37.0-10.1 (forky) | busybox 1:1.37.0-10.1 (forky) |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
osv7.0HIGH
vendor_debian7.0HIGH
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
BusyBox TAR Archive file inclusion (Nessus ID 298799)
vuldb·2026-05-06·CVSS 7.0
CVE-2026-26158 [HIGH] BusyBox TAR Archive file inclusion (Nessus ID 298799)
A vulnerability classified as problematic has been found in BusyBox. Impacted is an unknown function of the component TAR Archive Handler. Performing a manipulation results in file inclusion.
This vulnerability was named CVE-2026-26158. The attack may be initiated remotely. There is no available exploit.
To fix this issue, it is recommended to deploy a patch.
GHSA
GHSA-r8f8-4pgh-4m8v: A flaw was found in BusyBox
ghsa_unreviewed·2026-02-11
CVE-2026-26158 [HIGH] CWE-73 GHSA-r8f8-4pgh-4m8v: A flaw was found in BusyBox
A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.
OSV
CVE-2026-26158: A flaw was found in BusyBox
osv·2026-02-11·CVSS 7.0
CVE-2026-26158 [HIGH] CVE-2026-26158: A flaw was found in BusyBox
A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.
Red Hat
busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries
vendor_redhat·2026-02-11·CVSS 7.0
CVE-2026-26158 [HIGH] CWE-73 busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries
busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries
A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.
A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to pr
Debian
CVE-2026-26158: busybox - A flaw was found in BusyBox. This vulnerability allows an attacker to modify fil...
vendor_debian·2026·CVSS 7.0
CVE-2026-26158 [HIGH] CVE-2026-26158: busybox - A flaw was found in BusyBox. This vulnerability allows an attacker to modify fil...
A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 1:1.37.0-10.1)
sid: resolved (fixed in 1:1.37.0-10.1)
trixie: open
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-26158 busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries [fedora-42]
bugzilla·2026-02-11·CVSS 7.0
CVE-2026-26158 [HIGH] CVE-2026-26158 busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries [fedora-42]
CVE-2026-26158 busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.
Package Maintainer: If you wish for this bug to remain open because you
plan to fix i
Bugzilla
CVE-2026-26158 busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries
bugzilla·2026-02-11·CVSS 7.0
CVE-2026-26158 [HIGH] CVE-2026-26158 busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries
CVE-2026-26158 busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries
Affects: BusyBox v1.36.1 and v1.37.0 (likely affects earlier versions too)
CVSS: 9.3 (CRITICAL)
Component: data_extract_all.c in tar extraction - hardlink and symlink
handling
Description:
Hardlink entries in tar archives are created without validation of the
link_target path. This allows modification of files outside the extraction
directory and bypasses existing path traversal mitigations. This
vulnerability has higher impact than the path traversal issue as it does
not rely on relative paths or the current working directory.
Technical Details:
- Hardlink entries can point to absolute paths like /etc/passwd
- Symlink entries suffer from the same root cause (missing
Wiz
CVE-2026-26158 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.8
CVE-2026-26158 [HIGH] CVE-2026-26158 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-26158 :
CBL Mariner vulnerability analysis and mitigation
A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.
Source : NVD
## 7
Score
Published February 11, 2026
Severity HIGH
CNA Score 7.0
Affected Technologies
CBL Mariner
Linux Debian
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.2
Exploitation Probability (EPSS) N/A
Affected pac
https://access.redhat.com/errata/RHSA-2026:13831https://access.redhat.com/security/cve/CVE-2026-26158https://bugzilla.redhat.com/show_bug.cgi?id=2439040https://git.busybox.net/busybox/commit/archival?id=3fb6b31c716669e12f75a2accd31bb7685b1a1cbhttps://access.redhat.com/errata/RHSA-2026:13831https://access.redhat.com/security/cve/CVE-2026-26158https://bugzilla.redhat.com/show_bug.cgi?id=2439040https://cert-portal.siemens.com/productcert/html/ssa-253495.htmlhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26158.json
2026-02-11
Published