Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108119— Busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fix

Quick assessment

Affected
Red Hat Red Hat Enterprise Linux 6
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

发现 BusyBox 中存在一个安全漏洞。其 tar 小程序在处理具有不安全目标外观的符号链接（symlink）和硬链接（hardlink）条目时，采用延迟创建链接的方式，但在最终创建链接后，并未验证解析后的目标路径是否仍然位于提取目录之内。攻击者可以利用一个目标路径恰好为 “..” 的符号链接，结合一个延迟创建的硬链接，在提取目录之外创建新文件；或者通过重复使用提取目录处理多个归档文件，替换该目录之外的现有文件。如果以 elevated privileges（高权限）执行归档提取操作，此漏洞可能导致权限提升或任意

CVSS 6.3 · Medium

Affected Version Matrix 2

VendorProduct Version RangeStatus
Red Hat Red Hat Enterprise Linux 6 any affected
Red Hat Red Hat Hardened Images any affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108119

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fix
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive using a symlink target of exactly '..' combined with a deferred hardlink to create a new file outside the extraction directory, or reuse an extraction directory across two archives to replace an existing file outside it. If the archive is extracted with elevated privileges, this flaw can lead to privilege escalation or arbitrary code execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在文件访问前对链接解析不恰当(链接跟随)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Enterprise Linux 6 - cpe:/o:redhat:enterprise_linux:6
Red Hat Red Hat Hardened Images - cpe:/a:redhat:hummingbird:1

II. Public POCs for CVE-2026-108119

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108119

请登录查看更多情报信息。

Other References for CVE-2026-108119 (2)

Same Patch Batch · Red Hat · 2026-10-09 · 6 CVEs total

CVE-2026-107935 9.3 CRITICAL Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via
CVE-2026-108093 5.5 MEDIUM Gimp: gimp: denial of service via null pointer dereference in xcf simulation parasite load
CVE-2026-108063 5.5 MEDIUM Libhangul: null pointer dereference in hanja_new() when looking up a malformed hanja dicti
CVE-2026-107889 5.5 MEDIUM Keycloak-services: keycloak-services: stored xss on login page via kcsanitize bypass
CVE-2026-107655 4.0 MEDIUM Cups: null pointer dereference via embedded job ticket comments allows remote denial of se

IV. Related Vulnerabilities

Same product: Red Hat Enterprise Linux 6
Same vendor: Red Hat
Same weakness: CWE-59

V. Comments for CVE-2026-108119

No comments yet

Leave a comment