# CVE-2026-79655: Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write

Status: published. Published: 2026-08-25. Updated: 2026-11-04.

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root.

## Remediation

- workaround: To mitigate this issue, avoid using the `sos clean` utility to extract tar archives from untrusted or unknown sources. This vulnerability requires user interaction to process a specially crafted archive. (source: CNA: redhat)

## Affected products and versions

- Red Hat / Red Hat Enterprise Linux 10 (sos): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 6 (sos): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 7 (sos): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8 (sos): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (sos): Version range not reported. Source: CNA: redhat

## Severity and prioritization

- CVSS 3.1: 7.8 (high); CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; source: CNA: redhat

- CISA KEV: No listing in collected sources

- EPSS: 0.21% as of 2026-11-04; percentile 11.85%

- SSVC: exploitation poc; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-59

## Exploit evidence

- exploit: https://github.com/sosreport/sos/issues/4460 (ADP: CISA-ADP)

## References

- https://access.redhat.com/security/cve/CVE-2026-79655 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2523363 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

- https://github.com/sosreport/sos/issues/4460 (CNA: redhat)

- https://github.com/sosreport/sos/pull/4461 (CNA: redhat)

- https://github.com/sosreport/sos/issues/4460 (ADP: CISA-ADP; exploit)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-79655; retrieved 2026-11-05; source updated 2026-11-04

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-79655; retrieved 2026-11-05; source updated Not reported

Revision: 3bae572e435c9b3cc39876ff565255182c8d80d9e2799a0192f493da0f9e1ce2

Canonical: https://y2.dev/cve/CVE-2026-79655

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.