CVE-2026-26157

> 文章来源: Exploit-DB

> 抓取时间: 202605050803

> 原文 ID: article_746

> 生成时间: 2026-05-05 14:17

基础信息

字段值 CVECVE-2026-26157 CVSS 估计7.0-8.9 漏洞类型path_traversal 受影响组件BusyBox 1.37.0

漏洞摘要

[webapps] BusyBox 1.37.0 - Path Traversal

根因分析

path_traversal

攻击向量

详见原文

PoC / 关键代码

# Google Dork: N/A
# Date: 2026-02-11
# Exploit Author: Calil Khalil
# Vendor Homepage: https://busybox.net
# Software Link: https://busybox.net/downloads/
# Version: BusyBox 1.36.1, 1.37.0
# Tested on: Ubuntu 22.04 LTS, Alpine Linux 3.19
# CVE: CVE-2026-26157

"""
BusyBox Path Traversal Vulnerabili

修复建议

archival/libarchive/unsafe_prefix.c uses strstr(cp, "/../") which only matches

Semgrep 检测 Hint

- id: auto-hint-cve_2026_26157
  pattern: 'open($PATH)'
  message: "Potential path_traversal - 参考 CVE-2026-26157"
  severity: WARNING
  languages: [python]

标签

path_traversal

*由 vuln_card_gen.py 自动生成，来源: Exploit-DB*

🤖 漏洞情报系统自动分析生成 · 2026-07-02