CVE-2026-82331
Received Received - Intake

Symlink Escape in Apache BuildStream Tar Plugin

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: Apache Software Foundation

Description
Improper link resolution before file access ('link following') vulnerability in the `tar` source plugin of Apache BuildStream running on Python < 3.12 allows malicious source tarballs to write files on the host, with the privileges of the user running BuildStream, via symlinks as part of source fetching. The impact of this issue is mitigated by: * BuildStream projects should only use trusted sources in their elements as otherwise the build output can also not be trusted * Tracking a source tarball pins its SHA256 hash, which prevents MITM attacks of users that are fetching an already tracked project * When running on Python >= 3.12, BuildStream >= 2.3.0 already makes use of the Python `tarfile` filter functionality, which blocks the symlink escape Users are recommended to upgrade to version 2.8.1, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-82331
EUVD
EUVD-2026-85113

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache buildstream 2.8.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a link following vulnerability in Apache BuildStream's tar source plugin. It affects Python versions below 3.12. Malicious source tarballs can use symlinks to write files on the host system with the privileges of the user running BuildStream during source fetching.

Detection Guidance

This vulnerability can be detected by checking the version of BuildStream and Python running on your system. Use 'buildstream --version' and 'python --version' to verify if you are running a vulnerable version (BuildStream < 2.8.1 and Python < 3.12).

Inspect source tarballs for symlinks or unexpected file paths. Use 'tar -tvf <tarball>' to list contents before extraction.

Impact Analysis

An attacker could potentially overwrite important files on your system, install malware, or escalate privileges by exploiting this vulnerability through a crafted tarball. The impact is limited if you only use trusted sources or have tracking with SHA256 hashes.

Compliance Impact

This vulnerability could lead to unauthorized file access or modification, potentially violating data integrity and confidentiality requirements in GDPR and HIPAA. Organizations must ensure proper source verification and updates to maintain compliance.

Mitigation Strategies

Upgrade BuildStream to version 2.8.1 or later. If using Python < 3.12, consider upgrading to Python 3.12 or later to enable tarfile filter protection.

Only use trusted sources in BuildStream projects. Verify SHA256 hashes of source tarballs to prevent MITM attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82331. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart