CVE-2026-79655
Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write
A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
7.8
Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write
A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root.
- Record
CVE-2026-79655- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-59
- Updated
- 2026-11-02
EUVDEUVD-2026-65492
7.8
A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root.
- Record
EUVD-2026-65492- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jhqm-m4j3-wqq2
7.8
A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a...
A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root.
- Record
GHSA-jhqm-m4j3-wqq2- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-59
- Updated
- 2026-11-02
NVD
7.8
A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root.
- Record
CVE-2026-79655- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-59
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-79655
7.8
A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root.
- Record
DEBIAN-CVE-2026-79655- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
OSVUBUNTU-CVE-2026-79655
7.8
A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root.
- Record
UBUNTU-CVE-2026-79655- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-98211 No score
CVE-2026-79655 affecting package sos for versions less than 4.6.1-3
A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root.
- Record
AZL-98211- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sosAzure Linux:3 |
before 4.6.1-3 | 4.6.1-3 |
sosDebian:13 |
All versions, plus listed versions 4.10.0-14.10.0-1~bpo12+14.10.0-1~bpo13+14.10.1-14.10.1-1~bpo12+1 Show 20 moreShow less4.10.1-1~bpo13+14.10.2-14.10.2-1+really4.9.1-1~bpo12+14.10.2-1~bpo12+14.10.2-1~bpo13+14.11.0-14.11.1-14.11.1-24.11.1-2~bpo13+14.11.2-14.11.2-1~bpo13+14.12.0-14.12.0-1~bpo13+14.12.0-24.12.0-2~bpo13+14.12.1-14.9.1-14.9.2-14.9.2-24.9.2-3 |
None known |
sosDebian:14 |
before 4.12.0-2, plus listed versions 4.10.0-14.10.0-1~bpo12+14.10.0-1~bpo13+14.10.1-14.10.1-1~bpo12+1 Show 18 moreShow less4.10.1-1~bpo13+14.10.2-14.10.2-1+really4.9.1-1~bpo12+14.10.2-1~bpo12+14.10.2-1~bpo13+14.11.0-14.11.1-14.11.1-24.11.1-2~bpo13+14.11.2-14.11.2-1~bpo13+14.12.0-14.12.0-1~bpo13+14.12.0-2~bpo13+14.9.1-14.9.2-14.9.2-24.9.2-3 |
4.12.0-2 |
sosreportUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 3.0-13.1-13.1-1ubuntu13.1-1ubuntu23.1-1ubuntu2.1 Show 5 moreShow less3.1-1ubuntu2.23.4-1~ubuntu14.04.13.5-1~ubuntu14.04.23.5-1~ubuntu14.04.33.5-1~ubuntu14.04.3+esm1 |
None known |
sosreportUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.2-2ubuntu13.2+git276-g7da50d6-13.2+git276-g7da50d6-23.2+git276-g7da50d6-33.2+git276-g7da50d6-3build1 Show 12 moreShow less3.2+git276-g7da50d6-3ubuntu13.4-1~ubuntu16.04.13.5-1~ubuntu16.04.23.5-1~ubuntu16.04.33.6-1ubuntu0.16.04.23.6-1ubuntu0.16.04.33.6-1ubuntu0.16.04.43.9-1ubuntu0.16.04.13.9-1ubuntu0.16.04.23.9.1-1ubuntu0.16.04.13.9.1-1ubuntu0.16.04.23.9.1-1ubuntu0.16.04.2+esm1 |
None known |
sosreportUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.4-13.5-13.5-1ubuntu13.5-1ubuntu23.5-1ubuntu3 Show 18 moreShow less3.5-1ubuntu3.18.04.13.6-1ubuntu0.18.04.23.6-1ubuntu0.18.04.33.6-1ubuntu0.18.04.43.9-1ubuntu0.18.04.13.9-1ubuntu0.18.04.23.9-1ubuntu0.18.04.33.9.1-1ubuntu0.18.04.13.9.1-1ubuntu0.18.04.23.9.1-1ubuntu0.18.04.34.1-1ubuntu0.18.04.14.1-1ubuntu0.18.04.24.1-1ubuntu0.18.04.34.3-1ubuntu0.18.04.14.3-1ubuntu0.18.04.24.4-1ubuntu0.18.04.14.4-1ubuntu0.18.04.34.8.2-0ubuntu0~18.04.1~esm1 |
None known |
sosreportUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.6-1ubuntu33.8-1ubuntu13.8-1ubuntu23.8-1ubuntu33.9-1ubuntu1 Show 20 moreShow less3.9-1ubuntu23.9-1ubuntu2.13.9.1-1ubuntu0.20.04.13.9.1-1ubuntu0.20.04.24.0-1~ubuntu0.20.04.14.0-1~ubuntu0.20.04.24.0-1~ubuntu0.20.04.34.1-1ubuntu0.20.04.14.1-1ubuntu0.20.04.24.1-1ubuntu0.20.04.34.2-1ubuntu0.20.04.14.3-1ubuntu0.20.04.14.3-1ubuntu0.20.04.24.4-1ubuntu0.20.04.14.5.6-0ubuntu1~20.04.14.5.6-0ubuntu1~20.04.24.7.2-0ubuntu1~20.04.14.7.2-0ubuntu1~20.04.24.8.2-0ubuntu0~20.04.14.11.1-0ubuntu0.20.04.1~esm1 |
None known |
sosreportUbuntu:22.04:LTS |
All versions, plus listed versions 4.1-1ubuntu24.1-1ubuntu34.2-1ubuntu24.3-1ubuntu14.3-1ubuntu2 Show 11 moreShow less4.3-1ubuntu2.14.4-1ubuntu1.22.04.14.5.6-0ubuntu1~22.04.14.5.6-0ubuntu1~22.04.24.7.2-0ubuntu1~22.04.14.7.2-0ubuntu1~22.04.24.8.2-0ubuntu0~22.04.14.8.2-0ubuntu0~22.04.24.9.2-0ubuntu0~22.04.14.10.2-0ubuntu0~22.04.14.11.2-0ubuntu0~22.04.1 |
None known |
sosreportUbuntu:24.04:LTS |
All versions, plus listed versions 4.5.6-0ubuntu24.5.6-0ubuntu44.7.2-0ubuntu1~24.04.14.7.2-0ubuntu1~24.04.24.8.2-0ubuntu0~24.04.1 Show 4 moreShow less4.8.2-0ubuntu0~24.04.24.9.2-0ubuntu0~24.04.14.10.2-0ubuntu0~24.04.14.11.2-0ubuntu0~24.04.1 |
None known |
sosUbuntu:26.10 |
All versions, plus listed versions 4.10.2-14.11.1-24.11.2-1 |
None known |
sosUbuntu:26.04:LTS |
All versions, plus listed versions 4.10.0-14.10.1-14.10.2-14.11.2-0ubuntu0.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| facts | NVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-79655 is a high vulnerability (CVSS 7.8) in Red Hat Enterprise Linux 10, published August 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in sos 4.6.1-3.
References
access.redhat.com/security/cve/CVE-2026-79655
bugzilla.redhat.com/show_bug.cgi?id=2523363
github.com/sosreport/sos/issues/4460
github.com/sosreport/sos/pull/4461
nvd.nist.gov/vuln/detail/CVE-2026-79655
github.com/advisories/GHSA-jhqm-m4j3-wqq2
security-tracker.debian.org/tracker/CVE-2026-79655
ubuntu.com/security/CVE-2026-79655
cve.org/CVERecord?id=CVE-2026-79655