Every CVE Search/ Get API key

CVE-2026-26158

Busybox: busybox: arbitrary file modification and privilege escalation via unvalidated tar archive entries

7.0 HighFix available

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.19%Up 0.2 points since Feb 12, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.0

Busybox: busybox: arbitrary file modification and privilege escalation via unvalidated tar archive entries

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

Record
CVE-2026-26158
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-73, CWE-73
Updated
2026-11-04
EUVDEUVD-2026-7020 7.0

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

Record
EUVD-2026-7020
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-04
GitHub AdvisoriesGHSA-r8f8-4pgh-4m8v 7.0

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the...

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

Record
GHSA-r8f8-4pgh-4m8v
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-73
Updated
2026-11-02
NVD 7.0

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

Record
CVE-2026-26158
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-73
Updated
2026-11-05
OSVBELL-CVE-2026-26158 7.0
Record
BELL-CVE-2026-26158
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2026-26158 7.0

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

Record
DEBIAN-CVE-2026-26158
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-05
Show 12 moreShow less
OSVOESA-2026-1544 7.0

busybox security update

The Swiss Army Knife of Embedded Linux

Security Fix(es):

A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file overwrite, potentially enabling code execution through the modification of sensitive system files.(CVE-2026-26157)

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.(CVE-2026-26158)

Record
OESA-2026-1544
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:13831 7.0

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:13831
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-26158 7.0

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

Record
UBUNTU-CVE-2026-26158
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-77606 No score

CVE-2026-26158 affecting package busybox for versions less than 1.35.0-17

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

Record
AZL-77606
Updated
2026-11-02
OSVAZL-77613 No score

CVE-2026-26158 affecting package busybox for versions less than 1.36.1-22

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

Record
AZL-77613
Updated
2026-11-05
OSVopenSUSE-SU-2026:10231-1 No score

busybox-1.37.0-9.1 on GA media

These are all security issues fixed in the busybox-1.37.0-9.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10231-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20387-1 No score

Security update for busybox

This update for busybox fixes the following issues:

Changes in busybox:

  • CVE-2026-26157: Fixed arbitrary file overwrite and potential code execution via incomplete path sanitization. (bsc#1258163)
  • CVE-2026-26158: Fixed arbitrary file modification and privilege escalation via unvalidated tar archive entries. (bsc#1258167)
Record
openSUSE-SU-2026:20387-1
Updated
2026-11-02
OSVSUSE-SU-2026:0758-1 No score

Security update for busybox

This update for busybox fixes the following issues:

  • CVE-2026-26157: Arbitrary file overwrite and potential code execution via incomplete path sanitization (bsc#1258163).
  • CVE-2026-26158: Arbitrary file modification and privilege escalation via unvalidated tar archive entries (bsc#1258167).
Record
SUSE-SU-2026:0758-1
Updated
2026-11-02
OSVSUSE-SU-2026:0759-1 No score

Security update for busybox

This update for busybox fixes the following issues:

  • CVE-2026-26157: Arbitrary file overwrite and potential code execution via incomplete path sanitization (bsc#1258163).
  • CVE-2026-26158: Arbitrary file modification and privilege escalation via unvalidated tar archive entries (bsc#1258167).
Record
SUSE-SU-2026:0759-1
Updated
2026-11-02
OSVSUSE-SU-2026:0872-1 No score

Security update for busybox

This update for busybox fixes the following issues:

  • CVE-2023-42363: use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580).
  • CVE-2023-42364: use-after-free in the awk.c evaluate function (bsc#1217584).
  • CVE-2023-42365: use-after-free in the awk.c copyvar function (bsc#1217585).
  • CVE-2025-46394: files in a TAR archive can have their filenames hidden from a listing if terminal escape sequences are used when naming other files included in the archive (bsc#1241661).
  • CVE-2025-60876: request line incorrectly neutralized mat lead to header injection (bsc#1253245).
  • CVE-2026-26157: Arbitrary file overwrite and potential code execution via incomplete path sanitization (bsc#1258163).
  • CVE-2026-26158: Arbitrary file modification and privilege escalation via unvalidated tar archive entries (bsc#1258167).
  • CVE-2021-42380: Additional fix for use-after-realloc in awk (bsc#1192869).
Record
SUSE-SU-2026:0872-1
Updated
2026-11-02
OSVSUSE-SU-2026:0892-1 No score

Security update for busybox

This update for busybox fixes the following issues:

  • CVE-2023-42363: use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580).
  • CVE-2023-42364: use-after-free in the awk.c evaluate function (bsc#1217584).
  • CVE-2023-42365: use-after-free in the awk.c copyvar function (bsc#1217585).
  • CVE-2025-46394: files in a TAR archive can have their filenames hidden from a listing if terminal escape sequences are used when naming other files included in the archive (bsc#1241661).
  • CVE-2025-60876: request line incorrectly neutralized mat lead to header injection (bsc#1253245).
  • CVE-2026-26157: Arbitrary file overwrite and potential code execution via incomplete path sanitization (bsc#1258163).
  • CVE-2026-26158: Arbitrary file modification and privilege escalation via unvalidated tar archive entries (bsc#1258167).
  • CVE-2021-42380: Additional fix for use-after-realloc in awk (bsc#1192869).
Record
SUSE-SU-2026:0892-1
Updated
2026-11-02
OSVSUSE-SU-2026:20905-1 No score

Security update for busybox

This update for busybox fixes the following issues:

Changes in busybox:

  • CVE-2026-26157: Fixed arbitrary file overwrite and potential code execution via incomplete path sanitization. (bsc#1258163)
  • CVE-2026-26158: Fixed arbitrary file modification and privilege escalation via unvalidated tar archive entries. (bsc#1258167)
Record
SUSE-SU-2026:20905-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
busybox
Azure Linux:2
 before 1.35.0-17
1.35.0-17
busybox
Azure Linux:3
 before 1.36.1-22
1.36.1-22
busybox
Alpaquita:23
 1.35.0-r29 up to 1.35.0-r42
1.35.0-r42
busybox
Alpaquita:25
 1.37.0-r20 up to 1.37.0-r29
1.37.0-r29
busybox
Alpaquita:stream
 1.36.1-r1 up to 1.38.0-r0
1.38.0-r0
busybox
BellSoft Hardened Containers:23
 1.35.0-r29 up to 1.35.0-r42
1.35.0-r42
busybox
BellSoft Hardened Containers:25
 1.37.0-r20 up to 1.37.0-r29
1.37.0-r29
busybox
BellSoft Hardened Containers:stream
 1.36.1-r1 up to 1.38.0-r0
1.38.0-r0
busybox
Debian:12
 All versions, plus listed versions
1:1.35.0-41:1.35.0-4+deb12u11:1.36.0-1~exp11:1.36.1-11:1.36.1-2
Show 23 moreShow less
1:1.36.1-31:1.36.1-3.11:1.36.1-41:1.36.1-51:1.36.1-61:1.36.1-6~exp.11:1.36.1-71:1.36.1-81:1.36.1-91:1.37.0-11:1.37.0-101:1.37.0-10.11:1.37.0-21:1.37.0-31:1.37.0-41:1.37.0-51:1.37.0-61:1.37.0-71:1.37.0-81:1.37.0-91:1.38.0-11:1.38.0-21:1.38.0-3
 None known
busybox
Debian:13
 All versions, plus listed versions
1:1.37.0-101:1.37.0-10.11:1.37.0-61:1.37.0-71:1.37.0-8
Show 4 moreShow less
1:1.37.0-91:1.38.0-11:1.38.0-21:1.38.0-3
 None known
Show 38 moreShow less
Affected packages
PackageAffectedFixed
busybox
Debian:14
 before 1:1.37.0-10.1, plus listed versions
1:1.37.0-101:1.37.0-61:1.37.0-71:1.37.0-81:1.37.0-9
1:1.37.0-10.1
busybox
openEuler:20.03-LTS-SP4
From an advisory covering 2 CVEs
 before 1.31.1-28.oe2003sp4
1.31.1-28.oe2003sp4
busybox
openEuler:22.03-LTS-SP4
From an advisory covering 2 CVEs
 before 1.34.1-28.oe2203sp4
1.34.1-28.oe2203sp4
busybox
openEuler:24.03-LTS
From an advisory covering 2 CVEs
 before 1.36.1-14.oe2403sp3
1.36.1-14.oe2403sp3
busybox
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 1.36.1-14.oe2403sp1
1.36.1-14.oe2403sp1
busybox
openEuler:24.03-LTS-SP2
From an advisory covering 2 CVEs
 before 1.36.1-14.oe2403sp2
1.36.1-14.oe2403sp2
busybox
openEuler:24.03-LTS-SP3
From an advisory covering 2 CVEs
 before 1.36.1-14.oe2403sp3
1.36.1-14.oe2403sp3
busybox
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.37.0-7.2.hum1
0:1.37.0-7.2.hum1
busybox-petitboot
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.37.0-7.2.hum1
0:1.37.0-7.2.hum1
busybox-shared
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.37.0-7.2.hum1
0:1.37.0-7.2.hum1
busybox
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 2 CVEs
 before 1.37.0-150500.10.17.1
1.37.0-150500.10.17.1
busybox
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 1.37.0-150500.10.17.1
1.37.0-150500.10.17.1
busybox
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 1.37.0-150500.10.17.1
1.37.0-150500.10.17.1
busybox
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 2 CVEs
 before 1.37.0-150500.10.17.1
1.37.0-150500.10.17.1
busybox
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 2 CVEs
 before 1.37.0-150500.10.17.1
1.37.0-150500.10.17.1
busybox
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 2 CVEs
 before 1.37.0-150500.10.17.1
1.37.0-150500.10.17.1
busybox
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 1.37.0-150500.10.17.1
1.37.0-150500.10.17.1
busybox-links
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 1.37.0-150500.7.11.1
1.37.0-150500.7.11.1
busybox
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 2 CVEs
 before 1.37.0-150700.18.15.1
1.37.0-150700.18.15.1
busybox
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 8 CVEs
 before 1.35.0-150400.3.14.1
1.35.0-150400.3.14.1
busybox
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 8 CVEs
 before 1.35.0-150400.3.14.1
1.35.0-150400.3.14.1
busybox
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 8 CVEs
 before 1.35.0-150400.3.14.1
1.35.0-150400.3.14.1
busybox
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 8 CVEs
 before 1.35.0-150400.3.14.1
1.35.0-150400.3.14.1
busybox
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 8 CVEs
 before 1.35.0-10.3.1
1.35.0-10.3.1
busybox
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 8 CVEs
 before 1.35.0-10.3.1
1.35.0-10.3.1
busybox
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 1.37.0-160000.5.1
1.37.0-160000.5.1
busybox
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 1.37.0-160000.5.1
1.37.0-160000.5.1
busybox
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1:1.20.0-8.1ubuntu11:1.20.0-9ubuntu11:1.20.0-9ubuntu21:1.21.0-1ubuntu11:1.21.0-1ubuntu1.41:1.21.0-1ubuntu1.4+esm1
 None known
busybox
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1:1.22.0-15ubuntu11:1.22.0-15ubuntu1.41:1.22.0-15ubuntu1.4+esm11:1.22.0-15ubuntu1.4+esm2
 None known
busybox
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1:1.22.0-19ubuntu21:1.27.2-1ubuntu31:1.27.2-1ubuntu41:1.27.2-2ubuntu21:1.27.2-2ubuntu3
Show 5 moreShow less
1:1.27.2-2ubuntu3.11:1.27.2-2ubuntu3.21:1.27.2-2ubuntu3.31:1.27.2-2ubuntu3.41:1.27.2-2ubuntu3.4+esm1
 None known
busybox
Ubuntu:20.04:LTS
 All versions, plus listed versions
1:1.30.1-4ubuntu41:1.30.1-4ubuntu51:1.30.1-4ubuntu61:1.30.1-4ubuntu6.11:1.30.1-4ubuntu6.21:1.30.1-4ubuntu6.31:1.30.1-4ubuntu6.41:1.30.1-4ubuntu6.5
 None known
busybox
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:1.30.1-6ubuntu31:1.30.1-7ubuntu11:1.30.1-7ubuntu21:1.30.1-7ubuntu31:1.30.1-7ubuntu3.1
 None known
busybox
Ubuntu:24.04:LTS
 All versions, plus listed versions
1:1.36.1-3ubuntu11:1.36.1-6ubuntu11:1.36.1-6ubuntu31:1.36.1-6ubuntu3.1
 None known
busybox
Ubuntu:25.10
 All versions, plus listed versions
1:1.37.0-4ubuntu1
 None known
busybox
Ubuntu:26.10
 All versions, plus listed versions
1:1.37.0-7ubuntu11:1.37.0-10.1ubuntu21:1.37.0-10.1ubuntu31:1.38.0-3ubuntu11:1.38.0-3ubuntu31:1.38.0-3ubuntu4
 None known
busybox
Ubuntu:26.04:LTS
 All versions, plus listed versions
1:1.37.0-4ubuntu11:1.37.0-7ubuntu1
 None known
busybox
openSUSE:Tumbleweed
 before 1.37.0-9.1
1.37.0-9.1
busybox
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 1.37.0-160000.5.1
1.37.0-160000.5.1

History

History
RecordedChangedSources
affectedEUVD, NVD, OSV
factsCVE List
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-26158 is a high vulnerability (CVSS 7.0) in Red Hat Enterprise Linux 6, published February 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in busybox 1.35.0-17.

References

Show 35 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open