What is the CVSS score of CVE-2026-26158?

CVE-2026-26158 has a contested CVSS base score of 7.0 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of BusyBox. This are affected by CVE-2026-26158?

CVE-2026-26158 affects BusyBox and allows attackers to write files outside intended directories through malicious tar archives, potentially compromising system integrity and enabling unauthorized…. A patch is available.

How to fix or mitigate CVE-2026-26158?

Within 24 hours: Identify all systems running BusyBox and document usage patterns, particularly tar extraction functionality. Within 7 days: Implement input validation controls, disable BusyBox tar extraction where possible, and restrict file extraction to sandboxed environments with limited permissions. Within 30 days: Develop a patching strategy and maintain close monitoring of vendor security advisories for patch availability.

BusyBox. This CVE-2026-26158

HIGH

External Control of File Name or Path (CWE-73)

2026-02-11 secalert@redhat.com

Privilege Escalation Authentication Bypass

High

Disputed · 7.0 Vendor: redhat

Severity by source

Sources disagree (Low–High)

Vendor (redhat) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

3.1 LOW

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat

7.0 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: redhat

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 10, 2026 - 08:30 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 11, 2026 - 21:16 nvd

HIGH 7.0

DescriptionCVE.org

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

AnalysisAI

D-Link products using BusyBox are vulnerable to privilege escalation through malicious tar archives containing unvalidated symlink or hardlink entries that extract files outside the intended directory. An attacker with local access can craft a specially crafted archive to modify critical system files when extraction occurs with elevated privileges, potentially gaining unauthorized system access. No patch is currently available for this vulnerability.

Technical ContextAI

was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

Affected ProductsAI

A flaw was found in BusyBox. This vulnerability

RemediationAI

Monitor vendor advisories for a patch.

Same weakness CWE-73 – External Control of File Name or Path

View all

CVE-2025-33053 HIGH POC

8.8

CVE-2023-4634 CRITICAL POC

9.8

CVE-2025-24054 MEDIUM POC

6.5

CVE-2025-0111 HIGH

7.1

CVE-2024-8517 CRITICAL POC

9.8

CVE-2024-55372 CRITICAL POC

9.8

CVE-2024-55371 CRITICAL POC

9.8

CVE-2025-29709 CRITICAL POC

9.8

Same technique Privilege Escalation

View all

CVE-2025-47812 CRITICAL POC

10.0

CVE-2013-0422 CRITICAL POC

9.8

CVE-2013-0632 CRITICAL POC

9.8

CVE-2017-5689 CRITICAL POC

9.8

CVE-2017-12635 CRITICAL POC

9.8

CVE-2016-10372 CRITICAL POC

9.8

CVE-2014-9583 CRITICAL POC

10.0

CVE-2012-0297 CRITICAL POC

10.0

Vendor StatusVendor

SUSE

Severity: Low

Product	Status
Container suse/sl-micro/6.0/baremetal-iso-image:2.1.4-6.135 Container suse/sl-micro/6.0/base-iso-image:2.1.4-5.135 Container suse/sl-micro/6.0/kvm-iso-image:2.1.4-6.142 Container suse/sl-micro/6.0/rt-iso-image:2.1.4-6.135	Affected
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.65 Container suse/sl-micro/6.0/base-os-container:2.1.3-7.34 Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.58 Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.67 Container suse/sl-micro/6.0/toolbox:13.2-9.19 Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE	Affected
Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.57 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.78 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.80 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.71 Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd	Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Fixed

CVE-2026-26158 vulnerability details – vuln.today

Back

BusyBox. This CVE-2026-26158

Severity by source

CVSS VectorVendor: redhat

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

Same weakness CWE-73 – External Control of File Name or Path

Same technique Privilege Escalation

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code