CVE-2026-108119 in BusyBox
Summary
by MITRE • 10/09/2026
A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive using a symlink target of exactly '..' combined with a deferred hardlink to create a new file outside the extraction directory, or reuse an extraction directory across two archives to replace an existing file outside it. If the archive is extracted with elevated privileges, this flaw can lead to privilege escalation or arbitrary code execution.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in BusyBox affects the tar applet's handling of deferred link creation for symbolic links and hardlinks that appear unsafe during extraction processes. This specific implementation flaw stems from a failure to validate whether the resolved destination path remains within the designated extraction directory after all symbolic link resolutions have been completed. In standard archive extraction workflows, security mechanisms are typically designed to prevent path traversal attacks by ensuring that files extracted from an untrusted source do not overwrite or create artifacts outside of the intended target directory. However, in this case, the validation logic is applied prematurely or incorrectly during the initial parsing phase rather than at the final point of file system interaction where symbolic links have been fully dereferenced to their absolute paths.
An attacker can exploit this flaw by crafting a malicious tar archive that combines specific link types to bypass directory containment checks. The attack vector involves creating a symlink with a target consisting exactly of two dots, which represents the parent directory in Unix-like file systems. By pairing this symlink with a deferred hardlink entry, an adversary can manipulate the extraction sequence such that when the system resolves the paths and creates the final links or files, the resulting destination path escapes the sandboxed extraction root. This allows for the creation of new files outside the expected directory structure or the modification of existing files located in parent directories or other sensitive locations on the file system.
The operational impact of this vulnerability is severe, particularly when archives are extracted using elevated privileges such as those held by the root user or services running with high-level permissions. If an attacker can trick a privileged process into extracting a crafted archive, they may achieve arbitrary code execution by overwriting critical system binaries, configuration files, or scripts that are executed during normal operation. Alternatively, if the extraction occurs in a context where file creation outside the directory is restricted but not strictly monitored for privilege boundaries, it could lead to unauthorized access control modifications. This effectively results in local privilege escalation, allowing an unprivileged user to gain administrative rights over the system.
From a technical classification perspective, this issue aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. The failure occurs because the application does not adequately restrict the use of external input that could influence file or directory operations by resolving relative paths into absolute ones without verifying containment within an allowed base directory. Furthermore, this vulnerability can be mapped to MITRE ATT&CK techniques related to Defense Evasion and Privilege Escalation, specifically those involving path manipulation to bypass access controls or overwrite system files for persistence and control.
Mitigation strategies should focus on updating BusyBox to a version where the tar applet has been patched to enforce strict validation of resolved paths prior to any file system operations. Developers must ensure that after resolving all symbolic links within an archive entry, the final absolute path is compared against the extraction root directory using canonicalized path comparison methods rather than simple string matching. Additionally, administrators should apply principle of least privilege by avoiding the use of elevated privileges for routine archive extraction tasks whenever possible. Implementing file integrity monitoring and restricting write permissions to critical system directories can also help mitigate the impact if such an exploitation attempt occurs in environments where immediate patching is not feasible.