Arbitrary File Creation via Path Traversal in sos clean Utility

Executive Summary

CVE-2026-79655 is a path traversal vulnerability in the sos package's 'sos clean' utility. It occurs during tar extraction when symlink and hardlink targets are not properly validated. A crafted tar archive can exploit this to write files to arbitrary system locations with the privileges of the sos clean process, which typically runs as root.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for suspicious tar archive extractions by sos clean. Check for unexpected file creation or modification in system directories. Review logs for sos clean processes handling untrusted archives. Use commands like 'ps aux | grep sos clean' to identify active processes and 'find / -type f -mtime -1' to detect recently created files.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a local attacker to create or overwrite arbitrary files on your system. Since sos clean often runs as root, the attacker could gain control over critical system files, leading to privilege escalation, data corruption, or service disruption. User interaction is required to process the malicious archive.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file creation or modification with root privileges, potentially violating data integrity and confidentiality requirements in GDPR and HIPAA. Unauthorized file access may result in exposure of sensitive personal or health data, non-compliance with access controls, and failure to maintain audit trails.

Useful 0 Not Useful 0

Mitigation Strategies

Avoid using sos clean to extract tar archives from untrusted sources. Update the sos package to the latest version once a patch is available. Restrict sos clean execution to trusted users only. Monitor system files for unauthorized changes and implement file integrity monitoring tools.

Useful 0 Not Useful 0