CVE-2026-26157

A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file overwrite, potentially enabling code execution through the modification of sensitive system files.

• CWE-73
• CWE-73

• https://access.redhat.com/errata/RHSA-2026:13831
• https://access.redhat.com/security/cve/CVE-2026-26157
• https://bugzilla.redhat.com/show_bug.cgi?id=2439039
• https://git.busybox.net/busybox/commit/archival?id=3fb6b31c716669e12f75a2accd31bb7685b1a1cb
• https://access.redhat.com/errata/RHSA-2026:13831
• https://access.redhat.com/security/cve/CVE-2026-26157
• https://bugzilla.redhat.com/show_bug.cgi?id=2439039
• https://cert-portal.siemens.com/productcert/html/ssa-253495.html
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26157.json

Published

Feb 11, 2026

Last Modified

Jul 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-26151Insufficient ui warning of dangerous operations in Windows R…7.1
• CVE-2026-26152Insecure storage of sensitive information in Windows Cryptog…7
• CVE-2026-26153Out-of-bounds read in Windows Encrypting File System (EFS) a…7.8
• CVE-2026-26154Improper input validation in Windows Server Update Service a…7.5
• CVE-2026-26155Microsoft Local Security Authority Subsystem Service Informa…6.5
• CVE-2026-26156Heap-based buffer overflow in Windows Hyper-V allows an unau…7.8
• CVE-2026-26158A flaw was found in BusyBox. This vulnerability allows an at…7
• CVE-2026-26159Missing authentication for critical function in Windows Remo…7.8
• CVE-2026-2616A vulnerability has been found in Beetel 777VR1 up to 01.00.…9.8
• CVE-2026-26160Missing authentication for critical function in Windows Remo…7.8
• CVE-2026-26161Untrusted pointer dereference in Windows Sensor Data Service…7.8
• CVE-2026-26162Access of resource using incompatible type ('type confusion'…7.8