CVE-2026-26157
HIGHRed Hat Enterprise Linux 6 - Path Traversal and Arbitrary File Write via BusyBox Archive Extraction
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2026-26157. PoCs published by Calil Khalil.
AI-analyzed exploit summary This exploit demonstrates a path traversal vulnerability in BusyBox 1.36.1 and 1.37.0 by creating a malicious TAR archive with a symlink that bypasses sanitization due to a flaw in the strip_unsafe_prefix() function, allowing arbitrary directory read via symlink traversal.
Description
A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file overwrite, potentially enabling code execution through the modification of sensitive system files.
Exploits (1)
This exploit demonstrates a path traversal vulnerability in BusyBox 1.36.1 and 1.37.0 by creating a malicious TAR archive with a symlink that bypasses sanitization due to a flaw in the strip_unsafe_prefix() function, allowing arbitrary directory read via symlink traversal.
References (5)
Scores
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H