CVE-2026-82331: Apache BuildStream Path Traversal Vulnerability

CVE-2026-82331 Overview

CVE-2026-82331 is a link following vulnerability in the tar source plugin of Apache BuildStream. The flaw affects BuildStream instances running on Python versions earlier than 3.12. Malicious source tarballs can leverage symbolic links during source fetching to write arbitrary files on the host system. Files are written with the privileges of the user running BuildStream, enabling potential system compromise. The vulnerability is classified under CWE-59: Improper Link Resolution Before File Access. Apache resolved the issue in BuildStream version 2.8.1.

Critical Impact

Malicious tarballs can escape extraction directories via symlinks and write files anywhere the BuildStream user has access, enabling arbitrary code execution or configuration tampering.

Affected Products

• Apache BuildStream versions prior to 2.8.1 when running on Python < 3.12
• The tar source plugin used during source fetching operations
• BuildStream projects consuming untrusted or previously untracked source tarballs

Discovery Timeline

• 2026-09-23 - CVE CVE-2026-82331 published to NVD
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-82331

Vulnerability Analysis

Apache BuildStream is a build orchestration tool that fetches sources from various origins, including tar archives. The tar source plugin extracts archive contents to a working directory during source fetching. When running on Python versions earlier than 3.12, the plugin does not enforce symlink safety during extraction. An attacker crafting a malicious tarball can embed symbolic links pointing outside the extraction directory. Subsequent archive entries following the symlink write data to arbitrary host paths.

The attack succeeds without authentication or user interaction beyond initiating a normal build. Because BuildStream operates over network-fetched sources, the vulnerability is remotely exploitable when a project references an attacker-controlled tarball URL.

Root Cause

The root cause is missing symlink validation in the tar extraction routine of the tar source plugin. Python 3.12 introduced the tarfile filter functionality, which blocks symlink escape by default. BuildStream 2.3.0 and later automatically use this filter when running on Python 3.12+. On older Python interpreters, the filter is unavailable, so the plugin extracts symlink entries without validating that link targets remain inside the extraction directory.

Attack Vector

An attacker publishes a malicious tarball or performs a machine-in-the-middle attack against an untracked source. When BuildStream fetches and extracts the archive, an embedded symlink such as evil -> /home/user/.ssh/authorized_keys causes subsequent tar entries to overwrite the target file. The mitigation notes clarify that tracking a source pins its SHA256 hash, which prevents tampering of already-tracked sources. Untracked or newly-added sources remain exposed. Refer to the Apache mailing list advisory and Openwall OSS Security post for full technical context.

Detection Methods for CVE-2026-82331

Indicators of Compromise

• Unexpected file writes outside BuildStream project directories during or immediately after bst source fetch or bst build operations
• Modifications to sensitive user files such as ~/.ssh/authorized_keys, ~/.bashrc, or ~/.config/* correlated with BuildStream execution
• Tar archives containing symbolic link entries whose targets resolve outside the archive root

Detection Strategies

• Inspect tarballs referenced by BuildStream elements for symlink entries using tar -tvf archive.tar.gz | grep '^l' before ingestion
• Audit BuildStream host processes for file system writes outside expected staging directories using auditd or eBPF-based file monitoring
• Track Python interpreter versions across build hosts and flag any BuildStream instance running on Python < 3.12

Monitoring Recommendations

• Enable file integrity monitoring on user home directories and system configuration paths on BuildStream hosts
• Log all outbound network fetches performed by BuildStream and correlate archive URLs against a trusted-source allowlist
• Alert on BuildStream processes writing to paths outside the project workspace or cache directory

How to Mitigate CVE-2026-82331

Immediate Actions Required

• Upgrade Apache BuildStream to version 2.8.1 or later on all build hosts
• Where feasible, upgrade the Python interpreter to 3.12 or later to activate the built-in tarfile symlink filter
• Restrict BuildStream execution to unprivileged, sandboxed user accounts with no access to sensitive host files

Patch Information

Apache BuildStream 2.8.1 fixes the improper link resolution issue in the tar source plugin. Users on Python 3.12 or later with BuildStream 2.3.0+ were already protected via the Python tarfile filter. Consult the Apache mailing list advisory for the full patch announcement.

Workarounds

• Use only trusted source tarballs in BuildStream project elements, since untrusted sources also compromise build output integrity
• Track all sources so BuildStream pins the SHA256 hash and rejects tampered archives on subsequent fetches
• Run BuildStream inside a container or dedicated user namespace to constrain the blast radius of arbitrary file writes

# Upgrade BuildStream to the patched release
pip install --upgrade 'BuildStream>=2.8.1'

# Verify the installed version
bst --version

# Pin source hashes by tracking all sources in a project
bst source track --deps all target.bst