CVE-2026-82331: Apache BuildStream: tar source extraction escape
CVE-2026-82331 lets malicious BuildStream tar sources write files on the host via symlinks.
42
CVE-2026-82331
- CVSS 3.1
- 9.8 critical
- EPSS
- —
- Published
- ·
- Modified
Description · NVD
Improper link resolution before file access ('link following') vulnerability in the `tar` source plugin of Apache BuildStream running on Python = 3.12, BuildStream >= 2.3.0 already makes use of the Python `tarfile` filter functionality, which blocks the symlink escape Users are recommended to upgrade to version 2.8.1, which fixes this issue.
- Weakness
- CWE-59
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H