A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-51eb024b20 advisory.

    # Security fix for CVE-2026-79655

    Fixes a path traversal vulnerability in `sos clean` tar extraction where unvalidated symlink and hardlink     targets could lead to arbitrary file writes during archive processing.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-594e78463a advisory.

    # Security fix for CVE-2026-79655

    Fixes a path traversal vulnerability in `sos clean` tar extraction where unvalidated symlink and hardlink     targets could lead to arbitrary file writes during archive processing.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-cf80902877 advisory.

    # Security fix for CVE-2026-79655

    Fixes a path traversal vulnerability in `sos clean` tar extraction where unvalidated symlink and hardlink     targets could lead to arbitrary file writes during archive processing.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 46 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-55bfd55650 advisory.

    Automatic update for sos-4.12.0-2.fc46.

    ##### **Changelog**

    ```
    * Tue Sep 29 2026 Sandro Bonazzola <sbonazzo@redhat.com> - 4.12.0-2
    - Fix cleaner to refuse out-of-tree tar members
    - Patches to fix cleaner refuse out of tree tar members on extract       {CVE-2026-79655}
    - Resolves: fedora#2523430

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local     attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker     can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not     properly validated. This enables the attacker to write files to arbitrary locations on the system with the     privileges of the sos clean process, which often runs as root. (CVE-2026-79655)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
364106	Fedora 43 : sos (2026-51eb024b20)	Nessus	Fedora Local Security Checks	Local	high
362554	Fedora 44 : sos (2026-594e78463a)	Nessus	Fedora Local Security Checks	Local	high
358430	Fedora 45 : sos (2026-cf80902877)	Nessus	Fedora Local Security Checks	Local	high
351111	Fedora 46 : sos (2026-55bfd55650)	Nessus	Fedora Local Security Checks	Local	high
339479	Linux Distros Unpatched Vulnerability : CVE-2026-79655	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-79655

high

Tenable Plugins

high

high

high

high

high