CVE-2026-26157
High · 7.0CVSS
7.0
EPSS
0.7%
Published
Feb 11, 2026
CISA due date
—
The record
A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file overwrite, potentially enabling code execution through the modification of sensitive system files.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | busybox | 0 | 1.35.0-150400.3.14.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | busybox | 0 | 1.35.0-150400.3.14.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | busybox | 0 | 1.37.0-150500.10.17.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | busybox | 0 | 1.37.0-150500.10.17.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | busybox | 0 | 1.37.0-150700.18.15.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | busybox | 0 | 1.35.0-150400.3.14.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | busybox | 0 | 1.37.0-150500.10.17.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | busybox | 0 | 1.37.0-150500.10.17.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | busybox | 0 | 1.35.0-150400.3.14.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | busybox | 0 | 1.37.0-150500.10.17.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | busybox | 0 | 1.37.0-150500.10.17.1 |
| openSUSE:Leap 15.6 | busybox | 0 | 1.37.0-150500.10.17.1 |
| openSUSE:Leap 15.6 | busybox-links | 0 | 1.37.0-150500.7.11.1 |
| openSUSE:Leap 16.0 | busybox | 0 | 1.37.0-160000.5.1 |
| openSUSE:Tumbleweed | busybox | 0 | 1.37.0-10.1 |
Related vulnerabilities
- CVE-2026-26158 A flaw was found in BusyBox. Also affects busybox
- CVE-2025-60876 BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in… Also affects busybox
- CVE-2026-29004 BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6… Also affects busybox
- CVE-2011-5325 Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5… Also affects busybox
- CVE-2016-2148 Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows… Also affects busybox
- CVE-2026-88899 knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request… CWE-73
- CVE-2026-53956 Rattler is a library that provides common functionality used within the conda ecosystem. CWE-73
- CVE-2026-79692 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-73