Detections
Analytics
CVE-2026-124745
medium
Description
A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links pointing outside the intended extraction directory. An attacker could provide a specially crafted archive that links to sensitive files outside the extraction tree, allowing subsequent extraction operations to overwrite arbitrary files on the system.
References
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-123407
https://bugzilla.redhat.com/show_bug.cgi?id=2571637