CVE-2026-26158: External Control of File Name or Path in Red Hat Red Hat Hardened Images
A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.
AI Analysis
Technical Summary
CVE-2026-26158 is a vulnerability in BusyBox affecting Red Hat Hardened Images. It arises from improper validation of hardlink or symlink entries in tar archives, enabling attackers to overwrite files outside the extraction directory. When such a malicious tar archive is extracted with elevated privileges, it can lead to privilege escalation, granting unauthorized access to sensitive system files. Red Hat has issued security advisories and updates for BusyBox packages (version 1.37.0-7.2.hum1) to address this flaw.
Potential Impact
Successful exploitation allows an attacker to modify files outside the intended extraction directory, potentially escalating privileges and gaining unauthorized access to critical system files. This can compromise system integrity and confidentiality.
Mitigation Recommendations
Red Hat has released updated BusyBox packages (busybox-1.37.0-7.2.hum1) that fix this vulnerability. Users of Red Hat Hardened Images should apply these security updates promptly. No alternative mitigations or workarounds are indicated in the vendor advisory.
CVE-2026-26158: External Control of File Name or Path in Red Hat Red Hat Hardened Images
Description
A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.
CVSS v3.1
Score 7.0high
Affected software
Red Hat
Red Hat Hardened Images
Red Hat
Red Hat Enterprise Linux 6
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-26158 is a vulnerability in BusyBox affecting Red Hat Hardened Images. It arises from improper validation of hardlink or symlink entries in tar archives, enabling attackers to overwrite files outside the extraction directory. When such a malicious tar archive is extracted with elevated privileges, it can lead to privilege escalation, granting unauthorized access to sensitive system files. Red Hat has issued security advisories and updates for BusyBox packages (version 1.37.0-7.2.hum1) to address this flaw.
Potential Impact
Successful exploitation allows an attacker to modify files outside the intended extraction directory, potentially escalating privileges and gaining unauthorized access to critical system files. This can compromise system integrity and confidentiality.
Mitigation Recommendations
Red Hat has released updated BusyBox packages (busybox-1.37.0-7.2.hum1) that fix this vulnerability. Users of Red Hat Hardened Images should apply these security updates promptly. No alternative mitigations or workarounds are indicated in the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-02-11T17:05:41.991Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/errata/RHSA-2026:13831","vendor":"Red Hat"},{"url":"https://access.redhat.com/security/cve/CVE-2026-26158","vendor":"Red Hat"}]
Threat ID: 698cea984b57a58fa1c97f4e
Added to database: 02/11/2026, 20:46:16 UTC
Last enriched: 07/15/2026, 08:42:14 UTC
Last updated: 09/10/2026, 22:10:26 UTC
Views: 393
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.