Skip to content
Fencer Vulns
medium 6.3

CVE-2026-108119 json

Busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fix

published 2026-10-09 30 d ago modified 2026-11-05 3 d ago also EUVD-2026-95914

cvss
6.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 2%
public exploits
0
none known

Summary

A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive using a symlink target of exactly '..' combined with a deferred hardlink to create a new file outside the extraction directory, or reuse an extraction directory across two archives to replace an existing file outside it. If the archive is extracted with elevated privileges, this flaw can lead to privilege escalation or arbitrary code execution.

Patch / fix

  • Red Hat Red Hat Hardened Images 1.37.0-9.4.hum1
  • busybox hummingbird 1 1.37.0-9.4.hum1
  • busybox-shared hummingbird 1 1.37.0-9.4.hum1
  • busybox-petitboot hummingbird 1 1.37.0-9.4.hum1

red hat advisories RHSA-2026:81391

  • busybox openSUSE Tumbleweed 1.38.0-4.1

opensuse advisories openSUSE-SU-2026:12376-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-108119 updated cvss 6.3

busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses CVE-2026-26158 fix

  • Red Hat Enterprise Linux 6 busybox, busybox-petitboot
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Hardened Images busybox 1.37.0-9.4.hum1, busybox-shared 1.37.0-9.4.hum1, busybox-petitboot 1.37.0-9.4.hum1
    fixed: vendor fix RHSA-2026:81391

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
26 d ago

Exploit prediction

0.13% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.3 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

Affected products

  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat Enterprise Linux 6

Classification

Weakness
  • CWE-59 Improper Link Resolution Before File Access

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.