# CVE-2026-26158: BusyBox arbitrary file modification via unvalidated tar link entries

Source: https://junglewise.ai/threats/cve-2026-26158-busybox-arbitrary-file-modification-via-unvalidated-tar-link  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-11. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-26158 · Severity: high · CVSS 7 · Published 2026-02-11

BusyBox is a software suite providing many standard Unix tools in a single small executable, commonly used in embedded systems and network devices. A vulnerability in its archive extraction tool allows a malicious file to modify critical system files outside of the intended folder. If an administrator extracts a specially crafted archive, an attacker could gain full control of the system or escalate their privileges.

Technologies: [Busybox](https://junglewise.ai/threats/technologies/busybox), [Siemens RUGGEDCOM RST2428P](https://junglewise.ai/threats/technologies/ruggedcom-rst2428p), [Siemens SINEC OS](https://junglewise.ai/threats/technologies/sinec-os). Vendors: [Busybox](https://junglewise.ai/threats/vendors/busybox), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2026-26158 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-26158 being exploited in the wild.

**How severe is CVE-2026-26158?** High severity, with a CVSS score of 7, published 11 February 2026.

**Which products and versions are affected?** Busybox 1.36.1, 1.37.0; Siemens RUGGEDCOM RST2428P before V4.0; Siemens SINEC OS before V4.0.

**Is there a fix for CVE-2026-26158?** A patch was published on 2026-05-05: Red Hat released security advisory RHSA-2026:13831 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-26158 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-26158?** Check whether you run Busybox, Siemens RUGGEDCOM RST2428P or Siemens SINEC OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal and arbitrary file modification vulnerability exists in BusyBox's tar extraction component (specifically data_extract_all.c). The flaw is caused by a lack of validation for link_target paths in hardlink and symlink entries within a tar archive. An attacker can craft a malicious archive where these links point to absolute paths (e.g., /etc/passwd) or locations outside the extraction directory. When the archive is extracted—typically requiring user interaction and often occurring with elevated privileges in firmware update or system maintenance scenarios—the utility will create or modify files at the targeted locations. This bypasses standard path traversal mitigations and can lead to privilege escalation. A fix has been committed to the BusyBox archival component, and vendors like Siemens and Red Hat have released updates.

## Affected products

- BusyBox BusyBox 1.36.1, 1.37.0
- Siemens SINEC OS before V4.0
- Siemens RUGGEDCOM RST2428P before V4.0

## Timeline

- 2026-02-11: disclosed: Initial report in Red Hat Bugzilla and NVD publication
- 2026-05-05: patched: Red Hat released security advisory RHSA-2026:13831
- 2026-06-02: advisory: Siemens released advisory SSA-253495 for SINEC OS products

## References

- [https://access.redhat.com/errata/RHSA-2026:13831](https://access.redhat.com/errata/RHSA-2026:13831)
- [https://access.redhat.com/security/cve/CVE-2026-26158](https://access.redhat.com/security/cve/CVE-2026-26158)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2439040](https://bugzilla.redhat.com/show_bug.cgi?id=2439040)
- [https://git.busybox.net/busybox/commit/archival?id=3fb6b31c716669e12f75a2accd31bb7685b1a1cb](https://git.busybox.net/busybox/commit/archival?id=3fb6b31c716669e12f75a2accd31bb7685b1a1cb)
- [https://cert-portal.siemens.com/productcert/html/ssa-253495.html](https://cert-portal.siemens.com/productcert/html/ssa-253495.html)

## Related threats

- [BusyBox divide-by-zero in volume identification FAT parser](https://junglewise.ai/threats/cve-2026-124742-a-flaw-was-found-in-busybox-the-volume-identification-component)
- [BusyBox httpd stack buffer overflow in subdirectory config](https://junglewise.ai/threats/cve-2026-124739-a-flaw-was-found-in-busybox-when-the-httpd-web-server-processes)
- [BusyBox heap buffer overflow in TFTP client](https://junglewise.ai/threats/cve-2026-124737-a-flaw-was-found-in-busybox-when-the-tftp-trivial-file-transfer)
- [BusyBox libarchive symlink directory traversal arbitrary file creation](https://junglewise.ai/threats/cve-2026-92205-busybox-libarchive-symlink-directory-traversal-arbitrary-file)
- [BusyBox udhcpc integer underflow in DHCP packet processing](https://junglewise.ai/threats/cve-2026-88833-a-flaw-was-found-in-busybox-s-udhcpc-dhcp-client-when-processing)