CVE-2026-26158
HIGH
MEDIUM
Priority: 0.01
BB Relevance:
29/100
Published: 2026-02-11
Modified: 2026-11-04
First seen: 2026-11-04
Status: active
Attack Surface
No Auth
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Local
AC:
High
PR:
None
UI:
Required
S:
Unchanged
C:
High
I:
High
A:
High
Description
A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.
Weakness Classification (1)
References & Advisories (6)
vendor-advisory
x_refsource_REDHAT
vdb-entry
x_refsource_REDHAT
issue-tracking
x_refsource_REDHAT