CVE-2026-26157 Busybox: busybox: arbitrary file overwrite and potential code execution via incomplete path sanitization
Attackers can craft malicious archives to overwrite arbitrary files via path traversal in BusyBox, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-26157?
CVE-2026-26157 is a high-severity path traversal vulnerability in Red Hat Enterprise Linux 6, published on 11 Feb 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file overwrite, potentially enabling code execution through the modification of sensitive system files.
Weakness: CWE-73
Which versions are affected by CVE-2026-26157?
Linux distribution packages (1)
busybox openSUSE:Tumbleweed | All versions | 1.37.0-10.1 |
How do I fix CVE-2026-26157?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-26157 being exploited?
There is no known exploitation of CVE-2026-26157 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as AZL-77603, AZL-77610, BELL-CVE-2026-26157, DEBIAN-CVE-2026-26157, ECHO-8f94-adfc-30e7, GHSA-xm63-5pjx-vrhp and 2 more.