CVE-2026-26158CWE-73

Busybox: busybox: arbitrary file modification and privilege escalation via unvalidated tar archive entries

High · published February 11, 2026

CVSS v3.1
7.0
EPSS
0%
Percentile
8.9
In the wild
Unconfirmed
What it is

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00196 · 8.9th percentile
Weakness
CWE-73 · External Control of File Name or Path
Published
2026-02-11T20:27Z
EPSS history
Timeline
  • 11 FEB 20:27Z
    Busybox: busybox: arbitrary file modification and privilege escalation via unvalidated tar archive entries
    cvelistv5