What’s Vulnerable › Vulnerabilities

CVE-2026-79655: Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-25 · updated 2026-10-06
• Weakness: CWE-59

Description

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root.

Affected products

• Red Hat Enterprise Linux 10: all versions
• Red Hat Enterprise Linux 8: all versions
• Red Hat Enterprise Linux 9: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-79655
• https://bugzilla.redhat.com/show_bug.cgi?id=2523363
• https://github.com/sosreport/sos/issues/4460
• https://github.com/sosreport/sos/pull/4461
• https://github.com/sosreport/sos/issues/4460

Get alerted when CVE-2026-79655 or the next vulnerability affects your stack