CVE-2026-26157
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
A flaw was found in BusyBox where incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that, when extracted under specific conditions, may write to files outside the intended directory.
Risk Assessment
The risk involves arbitrary file overwrite, potentially enabling code execution through the modification of sensitive system files.
Recommendation
Immediately update BusyBox to a patched version and avoid extracting archives from untrusted sources.
Other vulnerabilities in BusyBox
See all- CVE-2026-88836Unknown
This CVE candidate has been rejected by Red Hat Product Security because it is not a security vulnerability. BusyBox internal TLS is intentionally minimal and documents in FEATURE_WGET_HTTPS that it does not verify peer identity or provide full TLS security; missing Finished verify_data checking is consistent with that documented design and does not cross a separate security boundary warranting a CVE.
- CVE-2024-58251Low
In netstat in BusyBox through 1.37.0, local users can launch a network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.
- CVE-2023-42365Medium
A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.
- CVE-2023-42364Medium
A use-after-free vulnerability exists in BusyBox v1.36.1 in the evaluate function in awk.c. An attacker can cause a denial of service via a crafted awk pattern.
- CVE-2023-42363Medium
A use-after-free vulnerability was discovered in the xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.
- CVE-2017-16544High
In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature does not sanitize filenames, potentially leading to executing any escape sequences in the terminal.
- CVE-2011-5325High
Directory traversal vulnerability in the BusyBox implementation of tar before version 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.
- CVE-2016-2147High
Integer overflow in the DHCP client (udhcpc) in BusyBox before version 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, leading to an out-of-bounds heap write.
- CVE-2016-6301High
The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service via a forged NTP packet, triggering a communication loop.
- CVE-2026-88841Low
The vulnerability in BusyBox affects the write_status_file() function in the dpkg tool. Failure to reset a stale field cursor between package stanzas leads to out-of-bounds reads and corruption of the status file when removing multiple packages.
Original NVD description (English source)
A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file overwrite, potentially enabling code execution through the modification of sensitive system files.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS