BusyBox tar: Improper link resolution allows writes outside extraction directory
Summary
The tar applet in BusyBox improperly resolves deferred hardlink targets across symbolic links that point outside the intended extraction directory (CWE-59). An attacker can supply a crafted archive so that subsequent extraction operations overwrite arbitrary files on the system. Exploitation requires a user or automated process to extract the archive, and the CVSS vector assumes local access, high attack complexity and user interaction.
Affected
- Unknown. Specific BusyBox versions are not confirmed.
- The Red Hat CVE record lists Red Hat Hardened Images as affected by default and Red Hat Enterprise Linux 6 as unaffected by default.
Fixed in
Unknown.
Workaround
Red Hat states that no suitable mitigation is currently available. Interim precautions:
- Do not extract untrusted tar archives with BusyBox tar, especially as root or with elevated privileges.
- Reject archives containing symlink or hardlink entries with absolute or traversal targets.
- Extract archives into a dedicated, unprivileged directory and do not reuse it across archives from different sources.
Exploitation
- No known exploitation at the time of publication.
- No public exploit or CISA KEV listing is known.
Our recommendation
- Inventory BusyBox usage, including container base images, appliance firmware and embedded devices.
- Restrict automated extraction of untrusted archives, in particular in backup restores, CI/CD pipelines and container build steps.
- Apply the precautions above until a fix is confirmed.
- Check the Red Hat advisory and your vendors' firmware or image updates, and apply them once published.
- Track CVE-2026-108119, which may be related.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE page CVE-2026-124745 access.redhat.com
- Red Hat Bugzilla 2571637 bugzilla.redhat.com
- CVE Program record CVE-2026-124745 www.cve.org
- OffSeq threat radar CVE-2026-124745 radar.offseq.com
- OpenCVE CVE-2026-108119 (possibly related) app.opencve.io
- SentinelOne CVE-2026-26158 (related fix context) www.sentinelone.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:28.
Original description (NVD)
A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links pointing outside the intended extraction directory. An attacker could provide a specially crafted archive that links to sensitive files outside the extraction tree, allowing subsequent extraction operations to overwrite arbitrary files on the system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.