What is the CVSS score of CVE-2026-26157?

CVE-2026-26157 has a contested CVSS base score of 7.0 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of BusyBox. Incomplete are affected by CVE-2026-26157?

BusyBox archive extraction contains a path traversal vulnerability that could allow attackers to write files outside intended directories when processing malicious archives.. A patch is available.

Is there a public PoC exploit available for CVE-2026-26157?

Yes, a public proof-of-concept exploit is available for CVE-2026-26157. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-26157?

Within 24 hours: Inventory all systems running BusyBox and identify those performing archive extraction operations, particularly from untrusted sources. Within 7 days: Implement input validation to reject archives from untrusted sources and restrict BusyBox usage to trusted archives only; document all affected systems. Within 30 days: Monitor vendor advisories for patch availability; evaluate alternative archive utilities with better security track records or prepare for emergency patching upon release.

BusyBox. Incomplete CVE-2026-26157

HIGH

External Control of File Name or Path (CWE-73)

2026-02-11 secalert@redhat.com

RCE

High

Disputed · 7.0 Vendor: redhat

Severity by source

Sources disagree (Low–High)

Vendor (redhat) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

3.1 LOW

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat

7.0 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: redhat

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 10, 2026 - 08:30 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 11, 2026 - 21:16 nvd

HIGH 7.0

DescriptionCVE.org

A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file overwrite, potentially enabling code execution through the modification of sensitive system files.

AnalysisAI

BusyBox archive extraction utilities contain insufficient path validation that enables attackers to write files outside intended directories through specially crafted archives, potentially leading to arbitrary file overwrite and code execution on affected systems. Local attackers with user interaction can exploit this vulnerability to modify sensitive system files and gain elevated privileges. No patch is currently available for this vulnerability.

Technical ContextAI

was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file overwrite, potentially enabling code execution through the modification of sensitive system files.

Affected ProductsAI

A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities

RemediationAI

Monitor vendor advisories for a patch.

Same weakness CWE-73 – External Control of File Name or Path

View all

CVE-2025-33053 HIGH POC

8.8

CVE-2023-4634 CRITICAL POC

9.8

CVE-2025-24054 MEDIUM POC

6.5

CVE-2025-0111 HIGH

7.1

CVE-2024-8517 CRITICAL POC

9.8

CVE-2024-55372 CRITICAL POC

9.8

CVE-2026-18048 HIGH POC

7.5

CVE-2024-55371 CRITICAL POC

9.8

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2017-7269 CRITICAL POC

9.8

CVE-2022-47966 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2023-3519 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2016-4117 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Low

Product	Status
Container suse/sl-micro/6.0/baremetal-iso-image:2.1.4-6.135 Container suse/sl-micro/6.0/base-iso-image:2.1.4-5.135 Container suse/sl-micro/6.0/kvm-iso-image:2.1.4-6.142 Container suse/sl-micro/6.0/rt-iso-image:2.1.4-6.135	Affected
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.65 Container suse/sl-micro/6.0/base-os-container:2.1.3-7.34 Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.58 Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.67 Container suse/sl-micro/6.0/toolbox:13.2-9.19 Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE	Affected
Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.57 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.78 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.80 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.71 Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd	Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Fixed

CVE-2026-26157 vulnerability details – vuln.today

Back

BusyBox. Incomplete CVE-2026-26157

Severity by source

CVSS VectorVendor: redhat

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

Same weakness CWE-73 – External Control of File Name or Path

Same technique RCE

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code