CVE-2026-26157: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-26157 is a path traversal vulnerability in BusyBox's archive extraction utilities that allows an attacker to craft malicious archives capable of writing files outside the intended extraction directory. The flaw affects BusyBox v1.36.1 and v1.37.0 (and likely earlier versions), specifically within the strip_unsafe_prefix() function used by tar, unzip, rpm, ar, and dpkg applets. It was disclosed on February 11, 2026, and carries a CVSS v3.1 base score of 7.0 (High) (Feedly, Red Hat Bugzilla).

The root cause is incomplete path sanitization (CWE-73: External Control of File Name or Path; estimated CWE-22: Path Traversal) in BusyBox's strip_unsafe_prefix() function, which fails to detect trailing .. components in archive entry filenames (e.g., logs/data/..). When the current working directory matches the target extraction location, this allows archive entries to resolve to paths outside the intended directory. An attacker must convince a user to extract a specially crafted archive, making user interaction a required precondition; no elevated privileges are needed. The attack vector is local, with high attack complexity (Red Hat Bugzilla, Feedly).

Successful exploitation enables arbitrary file overwrite on the target system, with high impact to confidentiality, integrity, and availability. An attacker could overwrite sensitive system files such as shell configuration files, cron jobs, or other privileged files, potentially enabling code execution in the context of the user or service performing the extraction. The scope is unchanged, meaning exploitation is contained to the affected system, but the ability to modify sensitive files creates a pathway for privilege escalation or persistent access (Red Hat Bugzilla, Feedly).

As of the latest available data, there is no confirmed public proof-of-concept exploit or evidence of in-the-wild exploitation, though references to potential PoC links (buaq.net, unsafe.sh) have appeared in threat intelligence feeds. The EPSS score is very low at 0.000050 (0.005%), reflecting limited current exploitation probability. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (Feedly).

1. Craft a malicious archive: Create a tar, zip, or other supported archive format containing an entry with a filename that includes a trailing .. path component (e.g., logs/data/.. resolving to a parent directory), targeting a sensitive file such as ~/.bashrc, a cron job, or an SSH authorized_keys file.
2. Deliver the archive: Distribute the malicious archive to the target via social engineering, a compromised download source, a supply chain attack, or any other means that results in the victim receiving the file.
3. Induce extraction: Convince the target user to extract the archive using a BusyBox utility (e.g., busybox tar -xf malicious.tar) from a working directory where the traversal path resolves to the intended target location.
4. Trigger path traversal: BusyBox's strip_unsafe_prefix() fails to strip the trailing .. component, causing the extracted file to be written outside the intended directory — overwriting the targeted sensitive file.
5. Achieve code execution: If the overwritten file is a shell configuration, cron job, or similar, the attacker's payload executes when the file is next processed by the system or user, enabling arbitrary code execution (Red Hat Bugzilla, Feedly).

• File System: Unexpected or modified files in directories outside the intended extraction path (e.g., ~/.bashrc, ~/.profile, /etc/cron.d/, ~/.ssh/authorized_keys); archive entries with filenames containing trailing .. components.
• Logs: System logs showing file modification timestamps inconsistent with normal user activity; audit logs (auditd) recording writes to sensitive files by BusyBox processes.
• Process: BusyBox archive extraction processes (tar, unzip) writing to paths outside the designated extraction directory; unexpected cron job execution or shell configuration changes following archive extraction events.

Red Hat has released a patched BusyBox package (busybox-1.37.0-7.2.hum1) for Red Hat Hardened Images as part of RHSA-2026:13831, and SUSE has issued security updates (SUSE-2026-0759-1, SUSE-2026-0758-1, SUSE-2026-0872). Dell has also addressed the issue in DSA-2026-158 for PowerProtect Data Manager. Where patching is not immediately possible, restrict archive extraction to trusted sources only, avoid running BusyBox extraction utilities on untrusted archives, and consider disabling archive extraction functionality where not operationally required. Monitor BusyBox archive extraction operations for anomalous file writes (Red Hat Advisory, Feedly).

Red Hat has classified the vulnerability as High severity and issued a security advisory (RHSA-2026:13831) addressing it alongside CVE-2026-26158. SUSE and Dell have also released patches, indicating broad vendor recognition of the issue. Coverage has appeared on Linux security news aggregators and community blogs, with Tenable publishing multiple Nessus detection plugins (298800, 300976, 301378, 302250, 302102) for affected distributions (Red Hat Advisory, Tenable).