CVE-2026-26158

HIGH

7.0

Description

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

Details CVE

Score CVSS v3.17.0

SeveriteHIGH

Vecteur CVSSCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Vecteur d'attaqueLOCAL

ComplexiteHIGH

Privileges requisNONE

Interaction utilisateurREQUIRED

Publie2/11/2026

Derniere modification2/12/2026

Sourcenvd

Observations honeypot0

Faiblesses (CWE)

CWE-73

References

https://access.redhat.com/security/cve/CVE-2026-26158(secalert@redhat.com)

https://bugzilla.redhat.com/show_bug.cgi?id=2439040(secalert@redhat.com)

https://git.busybox.net/busybox/commit/archival?id=3fb6b31c716669e12f75a2accd31bb7685b1a1cb(secalert@redhat.com)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.