Bug 2523430

Summary:	CVE-2026-79655 sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Vladimir Vasilev <vvasilev>
Component:	sos	Assignee:	Sandro Bonazzola <sbonazzo>
Status:	ASSIGNED ---	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	high
Version:	rawhide	CC:	bmr, sbonazzo
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["b9f9b52e-87d6-4f32-a91d-9ca690f07d5c"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2523363

Description Vladimir Vasilev 2026-08-25 13:30:40 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Upstream issue: https://github.com/sosreport/sos/issues/4460
Proposed Fix: https://github.com/sosreport/sos/pull/4461
Component: sos (sos/cleaner/archives/_init_.py — extract_archive())
CWE: CWE-22 and CWE-59
Suggested CVSS 3.1: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8)

Summary:
sos clean extracts a caller-supplied tarball with tarfile.fully_trusted_filter. A dest-containment check exists but only inspects member.name. It does not inspect symlink or hardlink targets. extractall() can therefore write files outside the extract directory as the process UID.

Description:
A path traversal vulnerability was found in sos clean in the sos package. The extract_archive() function uses Python's tarfile module with fully_trusted_filter and validates only archive member names against the extraction directory. Symlink and hardlink targets are not validated. A crafted tar archive can therefore contain an out-of-tree symlink followed by a regular file whose apparent path remains within the extraction directory. During extraction, tarfile.extractall() follows the symlink and writes the file to an attacker-controlled location outside the extraction directory. This can result in arbitrary file creation or overwrite with the privileges of the sos clean process, which is commonly run as root.

Reporter / Credit: Sandipan Roy (Red Hat)

Comment 1 Sandro Bonazzola 2026-08-25 14:55:05 UTC

Monitoring the upstream fix for this CVE, will include the fix once accepted upstream.
According to https://github.com/sosreport/sos/issues/4460#issuecomment-5411585864 doesn't seem to be a critical vulnerability, can wait for the proper fix.