Log in Start free

Vulnerability · Published Aug 25, 2026 · Assigned by redhat

CVE-2026-79655Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write

High 7.8

In plain English

A high-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 88.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13sosno fix listedDEBIAN-CVE-2026-79655
Debian:14sos4.12.0-2DEBIAN-CVE-2026-79655
Ubuntu:26.04:LTSsosno fix listedUBUNTU-CVE-2026-79655
Ubuntu:26.10sosno fix listedUBUNTU-CVE-2026-79655
Ubuntu:22.04:LTSsosreportno fix listedUBUNTU-CVE-2026-79655
Ubuntu:24.04:LTSsosreportno fix listedUBUNTU-CVE-2026-79655

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References