A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not… (CVE-2026-108119)

The BusyBox tar applet has a flaw in its deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets. Specifically, it does not verify that the resolved target of these links remains within the extraction directory after the deferred link is created. An attacker can exploit this by crafting a tar archive with a symlink target of '..' combined with a deferred hardlink, allowing creation of files outside the extraction directory or replacement of existing files outside it when reusing an extraction directory across archives. If extraction is performed with elevated privileges, this can lead to privilege escalation or arbitrary code execution.

This vulnerability can allow an attacker to create or overwrite files outside the intended extraction directory when extracting a malicious tar archive. If the extraction is done with elevated privileges, this can result in privilege escalation or arbitrary code execution, potentially compromising the system's integrity and security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid extracting untrusted tar archives with elevated privileges using BusyBox's tar applet. Consider alternative extraction methods or sandboxing extraction processes to limit potential impact.