High severity · published Feb 11, 2026
CVE-2026-26157
Busybox: busybox: arbitrary file overwrite and potential code execution via incomplete path sanitization
7.0
CVSS
0.7%
EPSS
No
On KEV
Description
A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file overwrite, potentially enabling code execution through the modification of sensitive system files.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Enterprise Linux 6 · Red Hat
All versions, or not specified · source: vendor, CISA
RH
Red Hat Hardened Images · Red Hat
All versions, or not specified · source: vendor, CISA
RR
RUGGEDCOM RST2428P · Siemens
before V4.0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-26157
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-26157
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:13831
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-26157
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2439039
git.busybox.net
https://git.busybox.net/busybox/commit/archival?id=3fb6b31c716669e12f75a2accd31bb7685b1a1cb
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-253495.html
security.access.redhat.com
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26157.json
More from Red Hat Enterprise Linux 6
8.8
CVE-2025-31277
Apple Multiple Products Buffer Overflow Vulnerability
7.5
CVE-2026-34486
Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
10.0
CVE-2026-4692
Sandbox escape in the Responsive Design Mode component
10.0
CVE-2026-4689
Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component
10.0
CVE-2026-4688
Sandbox escape due to use-after-free in the Disability Access APIs component