CVE-2026-108119: BusyBox Tar Privilege Escalation Flaw

CVE-2026-108119 Overview

CVE-2026-108119 is a path traversal vulnerability in the BusyBox tar applet. The flaw affects deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets. BusyBox does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive using a symlink target of exactly .. combined with a deferred hardlink to write a new file outside the extraction directory. The flaw also allows reusing an extraction directory across two archives to replace an existing file outside it. When the archive is extracted with elevated privileges, the attacker can achieve privilege escalation or arbitrary code execution. The weakness is classified as [CWE-59] Improper Link Resolution Before File Access.

Critical Impact

Extraction of a malicious tar archive by a privileged user can allow an attacker to write or replace files outside the intended extraction directory, enabling privilege escalation or arbitrary code execution.

Affected Products

• BusyBox tar applet (versions implementing deferred link-creation handling)
• Red Hat distributions referenced in advisory RHSA-2026:81391
• Embedded Linux systems and container base images that bundle BusyBox

Discovery Timeline

• 2026-10-09 - CVE CVE-2026-108119 published to NVD
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-108119

Vulnerability Analysis

The BusyBox tar applet defers creation of symlink and hardlink entries when the link target appears unsafe, such as containing .. components. The deferral logic intends to resolve such entries only after the remainder of the archive is extracted, so that final paths can be checked against the extraction root.

The check fails when a symlink target is exactly ... The applet does not re-validate that the resolved destination of a deferred hardlink stays within the extraction directory. An attacker who controls the archive contents can therefore cause writes to arbitrary file system locations reachable from the parent directory.

A second variant abuses extraction directory reuse. If the same extraction directory is used for two consecutive archives, the deferred-link state from the first archive can be leveraged to overwrite an existing file outside the extraction tree during the second extraction.

Root Cause

The root cause is incomplete validation of resolved link targets after deferred creation. The sanitization logic rejects obvious traversal strings in the raw target but does not re-check the final resolved path on disk. The .. symlink target bypasses the string-level check because it does not contain a path separator, yet still resolves to the parent of the extraction directory.

Attack Vector

Exploitation requires an attacker to supply a crafted tar archive and a victim to extract it with BusyBox tar. The impact is highest when extraction runs with elevated privileges, for example during package installation, firmware updates, container image unpacking, or administrative scripts. User interaction is required to trigger extraction, and the attack is local in CVSS terms because the extraction process is on the target host.

No verified public exploit code was referenced in the advisory. The vulnerability mechanism is described in prose; see the Red Hat CVE Report and Red Hat Bugzilla Report #2548611 for technical details.

Detection Methods for CVE-2026-108119

Indicators of Compromise

• Tar archives containing symlink entries whose target field equals exactly ..
• Tar archives mixing symlink entries with hardlink entries targeting the same name
• Unexpected files appearing in parent directories of a known extraction root after a busybox tar -x invocation
• Modification timestamps on sensitive system files that align with a tar extraction event

Detection Strategies

• Inspect tar archives before extraction with a parser that enumerates symlink and hardlink targets and flags any target equal to .. or containing traversal sequences
• Monitor process execution for busybox tar or tar invocations run as root, especially from scripts handling untrusted archives
• Audit file creation events outside the declared extraction directory during and immediately after archive extraction

Monitoring Recommendations

• Enable Linux audit rules for openat and linkat system calls originating from busybox processes to detect writes outside expected paths
• Correlate archive download events with subsequent extraction and file system writes to detect suspicious sequences
• Alert on reuse of a single extraction directory across multiple archive extractions in automated pipelines

How to Mitigate CVE-2026-108119

Immediate Actions Required

• Apply the vendor update referenced in Red Hat Security Advisory RHSA-2026:81391 and equivalent fixes from other distribution maintainers
• Avoid extracting untrusted tar archives with BusyBox tar running as root or with elevated capabilities
• Rebuild and redeploy container images and embedded firmware that bundle a vulnerable BusyBox binary

Patch Information

Red Hat has published RHSA-2026:81391 with updated BusyBox packages that correct the deferred link-creation validation. Administrators should install the patched package and restart or redeploy any long-running services, containers, or appliances that embed BusyBox. Review the Red Hat CVE Report for distribution-specific package versions.

Workarounds

• Extract untrusted archives inside a dedicated unprivileged user account, chroot, or container with no write access to sensitive host paths
• Use a non-BusyBox tar implementation that performs full path validation when processing archives from untrusted sources
• Never reuse the same extraction directory across multiple archive extractions in automated workflows
• Pre-scan archives and reject any entry whose symlink target equals .. or resolves outside the intended extraction root

# Example: extract untrusted archives as an unprivileged user in an isolated directory
sudo -u nobody mkdir -p /tmp/extract.$$
sudo -u nobody busybox tar -xf /path/to/untrusted.tar -C /tmp/extract.$$
# Validate contents before moving anything to a privileged location
find /tmp/extract.$$ -type l -printf '%p -> %l\n'