# CVE-2026-26157: BusyBox path traversal in archive extraction utilities

Source: https://junglewise.ai/threats/cve-2026-26157-busybox-path-traversal-in-archive-extraction-utilities  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-11. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-26157 · Severity: high · CVSS 7 · Published 2026-02-11

BusyBox, a widely used suite of command-line utilities for embedded systems and Linux distributions, contains a flaw in how it handles compressed archives. An attacker can create a specially crafted archive file that, when opened by a user, writes files to locations outside of the intended folder. This could allow an attacker to overwrite critical system files, potentially leading to a full system takeover or service disruption.

Technologies: [Busybox](https://junglewise.ai/threats/technologies/busybox), [Siemens RUGGEDCOM RST2428P](https://junglewise.ai/threats/technologies/ruggedcom-rst2428p), [Siemens SINEC OS](https://junglewise.ai/threats/technologies/sinec-os). Vendors: [Busybox](https://junglewise.ai/threats/vendors/busybox), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2026-26157 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-26157 being exploited in the wild.

**How severe is CVE-2026-26157?** High severity, with a CVSS score of 7, published 11 February 2026.

**Which products and versions are affected?** Busybox 1.36.1, 1.37.0; Siemens RUGGEDCOM RST2428P before V4.0; Siemens SINEC OS before V4.0.

**Is there a fix for CVE-2026-26157?** A patch was published on 2026-05-05: Red Hat released updated RPMs for Hardened Images Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-26157 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-26157?** Check whether you run Busybox, Siemens RUGGEDCOM RST2428P or Siemens SINEC OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in the strip_unsafe_prefix() function within BusyBox's archive extraction utilities, including tar, unzip, rpm, ar, and dpkg. The flaw is caused by incomplete path sanitization that fails to properly detect and strip trailing '..' components in filenames (e.g., 'logs/data/..'). If a user extracts a malicious archive while the current working directory matches the target location, the utility may write files outside the intended directory. This can be leveraged to overwrite sensitive system files like shell configurations or cron jobs to achieve arbitrary code execution. The vulnerability affects BusyBox versions 1.36.1 and 1.37.0.

## Affected products

- BusyBox BusyBox 1.36.1, 1.37.0
- Siemens SINEC OS before V4.0
- Siemens RUGGEDCOM RST2428P before V4.0

## Timeline

- 2026-02-11: disclosed: Initial report by Red Hat
- 2026-02-11: advisory: NVD entry published
- 2026-05-05: patched: Red Hat released updated RPMs for Hardened Images
- 2026-06-02: advisory: Siemens released advisory SSA-253495 for SINEC OS products

## References

- [https://access.redhat.com/errata/RHSA-2026:13831](https://access.redhat.com/errata/RHSA-2026:13831)
- [https://access.redhat.com/security/cve/CVE-2026-26157](https://access.redhat.com/security/cve/CVE-2026-26157)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2439039](https://bugzilla.redhat.com/show_bug.cgi?id=2439039)
- [https://git.busybox.net/busybox/commit/archival?id=3fb6b31c716669e12f75a2accd31bb7685b1a1cb](https://git.busybox.net/busybox/commit/archival?id=3fb6b31c716669e12f75a2accd31bb7685b1a1cb)
- [https://cert-portal.siemens.com/productcert/html/ssa-253495.html](https://cert-portal.siemens.com/productcert/html/ssa-253495.html)

## Related threats

- [BusyBox divide-by-zero in volume identification FAT parser](https://junglewise.ai/threats/cve-2026-124742-a-flaw-was-found-in-busybox-the-volume-identification-component)
- [BusyBox httpd stack buffer overflow in subdirectory config](https://junglewise.ai/threats/cve-2026-124739-a-flaw-was-found-in-busybox-when-the-httpd-web-server-processes)
- [BusyBox heap buffer overflow in TFTP client](https://junglewise.ai/threats/cve-2026-124737-a-flaw-was-found-in-busybox-when-the-tftp-trivial-file-transfer)
- [BusyBox libarchive symlink directory traversal arbitrary file creation](https://junglewise.ai/threats/cve-2026-92205-busybox-libarchive-symlink-directory-traversal-arbitrary-file)
- [BusyBox udhcpc integer underflow in DHCP packet processing](https://junglewise.ai/threats/cve-2026-88833-a-flaw-was-found-in-busybox-s-udhcpc-dhcp-client-when-processing)