Vulnerability in BusyBox Tar Applet Allows Privilege Escalation
CVE-2026-108119

6.3MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Hardened Images
Red Hat Enterprise Linux 6
Vendor
CVE Published:
9 October 2026

What is CVE-2026-108119?

A vulnerability exists in the tar applet of BusyBox that inadequately handles deferred link-creation for symlinks and hardlinks. This flaw allows an attacker to construct a malicious tar archive with a symlink target of '..', enabling them to create files outside the designated extraction directory. Furthermore, by reusing an extraction directory across multiple archives, it is possible for the attacker to replace existing files outside of the directory. If executed with elevated privileges, this vulnerability could result in privilege escalation or arbitrary code execution.

Affected Version(s)

Red Hat Hardened Images 1.37.0-9.4.hum1

References

https://access.redhat.com/errata/RHSA-2026:81391
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-108119
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2548611
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank TAE3 for reporting this issue.
.