CVE-2026-26158 Busybox: busybox: arbitrary file modification and privilege escalation via unvalidated tar archive entries
Attackers can modify arbitrary files and escalate privileges by extracting malicious tar archives with unvalidated hardlink or symlink entries in BusyBox.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-26158?
CVE-2026-26158 is a high-severity path traversal vulnerability in Red Hat Enterprise Linux 6, published on 11 Feb 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.
Weakness: CWE-73
Which versions are affected by CVE-2026-26158?
Linux distribution packages (1)
busybox openSUSE:Tumbleweed | All versions | 1.37.0-9.1 |
How do I fix CVE-2026-26158?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-26158 being exploited?
There is no known exploitation of CVE-2026-26158 in the wild and no public exploit code.
Sources
Also known as AZL-77606, AZL-77613, BELL-CVE-2026-26158, DEBIAN-CVE-2026-26158, ECHO-473c-40b9-e821, GHSA-r8f8-4pgh-4m8v and 2 more.