Junglewise Threat Intelligence

CVE-2026-26158: BusyBox arbitrary file modification via unvalidated tar link entries

CVE-2026-26158 · Severity: high · CVSS 7 · Published 2026-02-11

Technologies: Siemens RUGGEDCOM RST2428P, Busybox, Siemens SINEC OS. Vendors: Siemens, Busybox.

Executive brief

BusyBox is a software suite providing many standard Unix tools in a single small executable, commonly used in embedded systems and network devices. A vulnerability in its archive extraction tool allows a malicious file to modify critical system files outside of the intended folder. If an administrator extracts a specially crafted archive, an attacker could gain full control of the system or escalate their privileges.

Technical details

A path traversal and arbitrary file modification vulnerability exists in BusyBox's tar extraction component (specifically data_extract_all.c). The flaw is caused by a lack of validation for link_target paths in hardlink and symlink entries within a tar archive. An attacker can craft a malicious archive where these links point to absolute paths (e.g., /etc/passwd) or locations outside the extraction directory. When the archive is extracted—typically requiring user interaction and often occurring with elevated privileges in firmware update or system maintenance scenarios—the utility will create or modify files at the targeted locations. This bypasses standard path traversal mitigations and can lead to privilege escalation. A fix has been committed to the BusyBox archival component, and vendors like Siemens and Red Hat have released updates.

Affected products

  • BusyBox BusyBox 1.36.1, 1.37.0
  • Siemens SINEC OS before V4.0
  • Siemens RUGGEDCOM RST2428P before V4.0

Timeline

  • 2026-02-11: disclosed: Initial report in Red Hat Bugzilla and NVD publication
  • 2026-05-05: patched: Red Hat released security advisory RHSA-2026:13831
  • 2026-06-02: advisory: Siemens released advisory SSA-253495 for SINEC OS products

References

Related threats