CVE-2026-79655
Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write
CVE-2026-79655 is a high vulnerability (CVSS 7.8) in Red Hat Enterprise Linux 10, published August 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 18th percentile. Fixed in sos 4.6.1-3.
- Severity
- 7.8 HighCVSS 3.1, CVE List
- Exploit chance
- 0.26%EPSS, 18th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.6.1-3sos +16 more
Description
A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sosAzure Linux:3 | before 4.6.1-3 | 4.6.1-3 |
sosDebian:13 | All versions, plus listed versions 4.10.0-14.10.0-1~bpo12+14.10.0-1~bpo13+14.10.1-14.10.1-1~bpo12+1 Show 21 moreShow less4.10.1-1~bpo13+14.10.2-14.10.2-1+really4.9.1-1~bpo12+14.10.2-1~bpo12+14.10.2-1~bpo13+14.11.0-14.11.1-14.11.1-24.11.1-2~bpo13+14.11.2-14.11.2-1~bpo13+14.12.0-14.12.0-1~bpo13+14.12.0-24.12.0-2~bpo13+14.12.1-14.12.1-1~bpo13+14.9.1-14.9.2-14.9.2-24.9.2-3 | None known |
sosDebian:14 | before 4.12.0-2, plus listed versions 4.10.0-14.10.0-1~bpo12+14.10.0-1~bpo13+14.10.1-14.10.1-1~bpo12+1 Show 18 moreShow less4.10.1-1~bpo13+14.10.2-14.10.2-1+really4.9.1-1~bpo12+14.10.2-1~bpo12+14.10.2-1~bpo13+14.11.0-14.11.1-14.11.1-24.11.1-2~bpo13+14.11.2-14.11.2-1~bpo13+14.12.0-14.12.0-1~bpo13+14.12.0-2~bpo13+14.9.1-14.9.2-14.9.2-24.9.2-3 | 4.12.0-2 |
sosRed Hat:enterprise_linux:9::baseos | before 0:4.11.2-7.el9_9 | 0:4.11.2-7.el9_9 |
sos-auditRed Hat:enterprise_linux:9::baseos | before 0:4.11.2-7.el9_9 | 0:4.11.2-7.el9_9 |
sosRed Hat:enterprise_linux:10.3 | before 0:4.11.2-7.el10_3 | 0:4.11.2-7.el10_3 |
sosRocky Linux:9 | before 0:4.11.2-7.el9_9 | 0:4.11.2-7.el9_9 |
sos-auditRocky Linux:9 | before 0:4.11.2-7.el9_9 | 0:4.11.2-7.el9_9 |
sosRocky Linux:10 | before 0:4.11.2-7.el10_3 | 0:4.11.2-7.el10_3 |
sosreportUbuntu:Pro:14.04:LTS | All versions, plus listed versions 3.0-13.1-13.1-1ubuntu13.1-1ubuntu23.1-1ubuntu2.1 Show 5 moreShow less3.1-1ubuntu2.23.4-1~ubuntu14.04.13.5-1~ubuntu14.04.23.5-1~ubuntu14.04.33.5-1~ubuntu14.04.3+esm1 | None known |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
sosreportUbuntu:Pro:16.04:LTS | All versions, plus listed versions 3.2-2ubuntu13.2+git276-g7da50d6-13.2+git276-g7da50d6-23.2+git276-g7da50d6-33.2+git276-g7da50d6-3build1 Show 12 moreShow less3.2+git276-g7da50d6-3ubuntu13.4-1~ubuntu16.04.13.5-1~ubuntu16.04.23.5-1~ubuntu16.04.33.6-1ubuntu0.16.04.23.6-1ubuntu0.16.04.33.6-1ubuntu0.16.04.43.9-1ubuntu0.16.04.13.9-1ubuntu0.16.04.23.9.1-1ubuntu0.16.04.13.9.1-1ubuntu0.16.04.23.9.1-1ubuntu0.16.04.2+esm1 | None known |
sosreportUbuntu:Pro:18.04:LTS | All versions, plus listed versions 3.4-13.5-13.5-1ubuntu13.5-1ubuntu23.5-1ubuntu3 Show 18 moreShow less3.5-1ubuntu3.18.04.13.6-1ubuntu0.18.04.23.6-1ubuntu0.18.04.33.6-1ubuntu0.18.04.43.9-1ubuntu0.18.04.13.9-1ubuntu0.18.04.23.9-1ubuntu0.18.04.33.9.1-1ubuntu0.18.04.13.9.1-1ubuntu0.18.04.23.9.1-1ubuntu0.18.04.34.1-1ubuntu0.18.04.14.1-1ubuntu0.18.04.24.1-1ubuntu0.18.04.34.3-1ubuntu0.18.04.14.3-1ubuntu0.18.04.24.4-1ubuntu0.18.04.14.4-1ubuntu0.18.04.34.8.2-0ubuntu0~18.04.1~esm1 | None known |
sosreportUbuntu:Pro:20.04:LTS | All versions, plus listed versions 3.6-1ubuntu33.8-1ubuntu13.8-1ubuntu23.8-1ubuntu33.9-1ubuntu1 Show 20 moreShow less3.9-1ubuntu23.9-1ubuntu2.13.9.1-1ubuntu0.20.04.13.9.1-1ubuntu0.20.04.24.0-1~ubuntu0.20.04.14.0-1~ubuntu0.20.04.24.0-1~ubuntu0.20.04.34.1-1ubuntu0.20.04.14.1-1ubuntu0.20.04.24.1-1ubuntu0.20.04.34.2-1ubuntu0.20.04.14.3-1ubuntu0.20.04.14.3-1ubuntu0.20.04.24.4-1ubuntu0.20.04.14.5.6-0ubuntu1~20.04.14.5.6-0ubuntu1~20.04.24.7.2-0ubuntu1~20.04.14.7.2-0ubuntu1~20.04.24.8.2-0ubuntu0~20.04.14.11.1-0ubuntu0.20.04.1~esm1 | None known |
sosreportUbuntu:22.04:LTS | All versions, plus listed versions 4.1-1ubuntu24.1-1ubuntu34.2-1ubuntu24.3-1ubuntu14.3-1ubuntu2 Show 11 moreShow less4.3-1ubuntu2.14.4-1ubuntu1.22.04.14.5.6-0ubuntu1~22.04.14.5.6-0ubuntu1~22.04.24.7.2-0ubuntu1~22.04.14.7.2-0ubuntu1~22.04.24.8.2-0ubuntu0~22.04.14.8.2-0ubuntu0~22.04.24.9.2-0ubuntu0~22.04.14.10.2-0ubuntu0~22.04.14.11.2-0ubuntu0~22.04.1 | None known |
sosreportUbuntu:24.04:LTS | All versions, plus listed versions 4.5.6-0ubuntu24.5.6-0ubuntu44.7.2-0ubuntu1~24.04.14.7.2-0ubuntu1~24.04.24.8.2-0ubuntu0~24.04.1 Show 4 moreShow less4.8.2-0ubuntu0~24.04.24.9.2-0ubuntu0~24.04.14.10.2-0ubuntu0~24.04.14.11.2-0ubuntu0~24.04.1 | None known |
sosUbuntu:26.10 | All versions, plus listed versions 4.10.2-14.11.1-24.11.2-1 | None known |
sosUbuntu:26.04:LTS | All versions, plus listed versions 4.10.0-14.10.1-14.10.2-14.11.2-0ubuntu0.1 | None known |
What each source reports
CVE List Score used
Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write
A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root.
- Record
CVE-2026-79655- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-59
- Updated
- 2026-11-11
EUVDEUVD-2026-65492
A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root.
- Record
EUVD-2026-65492- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-11
GitHub AdvisoriesGHSA-jhqm-m4j3-wqq2
A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a...
A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root.
- Record
GHSA-jhqm-m4j3-wqq2- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-59
- Updated
- 2026-11-02
NVD
A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root.
- Record
CVE-2026-79655- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-59
- Updated
- 2026-11-11
OSVDEBIAN-CVE-2026-79655
A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root.
- Record
DEBIAN-CVE-2026-79655- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-11
OSVRHSA-2026:97867
Red Hat Security Advisory: sos security, bug fix, and enhancement update
- Record
RHSA-2026:97867- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-13
Show 5 moreShow less
OSVRHSA-2026:98076
Red Hat Security Advisory: sos security, bug fix, and enhancement update
- Record
RHSA-2026:98076- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-13
OSVRLSA-2026:97867
Important: sos security, bug fix, and enhancement update
The sos package contains a set of utilities that gather information from system hardware, logs, and configuration files. The information can then be used for diagnostic purposes and debugging.
Security Fix(es):
- sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write (CVE-2026-79655)
Bug Fix(es) and Enhancement(s):
- Hydra to GraphQL migration and sos upload [rhel-9.9.z] (JIRA:Rocky Linux-290949)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:97867- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-13
OSVRLSA-2026:98076
Important: sos security, bug fix, and enhancement update
The sos package contains a set of utilities that gather information from system hardware, logs, and configuration files. The information can then be used for diagnostic purposes and debugging.
Security Fix(es):
- sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write (CVE-2026-79655)
Bug Fix(es) and Enhancement(s):
- Hydra to GraphQL migration and sos upload (JIRA:Rocky Linux-290940)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:98076- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-13
OSVUBUNTU-CVE-2026-79655
A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root.
- Record
UBUNTU-CVE-2026-79655- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-98211No score
CVE-2026-79655 affecting package sos for versions less than 4.6.1-3
A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root.
- Record
AZL-98211- Updated
- 2026-11-05
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| affected, aliases, references | NVD, OSV | |
| affected | EUVD, OSV | |
| references | CVE List, NVD | |
| references | CVE List | |
| references | EUVD | |
| affected | OSV | |
| facts | NVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
access.redhat.com/errata/RHSA-2026:97867
bugzilla.redhat.com/show_bug.cgi?id=2523363
github.com/sosreport/sos/issues/4460
Show 10 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-79655
security-tracker.debian.org/tracker/CVE-2026-79655
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_97867.json
cve.org/CVERecord?id=CVE-2026-79655
errata.rockylinux.org/RLSA-2026:97867
ubuntu.com/security/CVE-2026-79655