Fedora 45 : buildstream (2026-d77557766a)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d77557766a advisory. CVE-2026-82331 CWE-59: tar source plugin symlink escape while fetching a malicious tarball Python = 3.12, so the packaged /usr/bin/bst was already using...

CVE-2026-82331

A flaw was found in the tar source plugin of Apache BuildStream. This improper link resolution vulnerability, also known as 'link following', allows a remote attacker to write arbitrary files on the host system. By crafting malicious source tarballs containing symlinks, an attacker can exploit th...

Apache BuildStream 2.8.0 (symlink) Arbitrary File Write

Summary BuildStream is a powerful software integration tool that allows developers to automate the integration of software components including operating systems, and to streamline the software development and production process. Description Apache BuildStream's tar source plugin extracts archive...

SUSE CVE-2026-82331

Improper link resolution before file access 'link following' vulnerability in the tar source plugin of Apache BuildStream running on Python = 3.12, BuildStream = 2.3.0 already makes use of the Python tarfile filter functionality, which blocks the symlink escape Users are recommended to upgrade to...

CVE-2026-82331

Improper link resolution before file access 'link following' vulnerability in the tar source plugin of Apache BuildStream running on Python = 3.12, BuildStream = 2.3.0 already makes use of the Python tarfile filter functionality, which blocks the symlink escape Users are recommended to upgrade to...

DEBIAN-CVE-2026-82331

Improper link resolution before file access 'link following' vulnerability in the tar source plugin of Apache BuildStream running on Python = 3.12, BuildStream = 2.3.0 already makes use of the Python tarfile filter functionality, which blocks the symlink escape Users are recommended to upgrade to...

UBUNTU-CVE-2026-82331

Improper link resolution before file access 'link following' vulnerability in the tar source plugin of Apache BuildStream running on Python = 3.12, BuildStream = 2.3.0 already makes use of the Python tarfile filter functionality, which blocks the symlink escape Users are recommended to upgrade to...

CVE-2026-82331

Improper link resolution before file access 'link following' vulnerability in the tar source plugin of Apache BuildStream running on Python = 3.12, BuildStream = 2.3.0 already makes use of the Python tarfile filter functionality, which blocks the symlink escape Users are recommended to upgrade to...

CVE-2026-82331 Apache BuildStream: tar source extraction escape

Improper link resolution before file access 'link following' vulnerability in the tar source plugin of Apache BuildStream running on Python = 3.12, BuildStream = 2.3.0 already makes use of the Python tarfile filter functionality, which blocks the symlink escape Users are recommended to upgrade to...

CVE-2026-82331

The Apache BuildStream tar source plugin contains an improper link resolution (link following) vulnerability when running on Python = 3.12 with BuildStream >= 2.3.0 due to the use of the Python tarfile filter functionality. Users are recommended to upgrade to version 2.8.1 to resolve the issue...

CVE-2026-82331 Apache BuildStream: tar source extraction escape

Improper link resolution before file access 'link following' vulnerability in the tar source plugin of Apache BuildStream running on Python = 3.12, BuildStream = 2.3.0 already makes use of the Python tarfile filter functionality, which blocks the symlink escape Users are recommended to upgrade to...

EUVD-2026-85113

Improper link resolution before file access 'link following' vulnerability in the tar source plugin of Apache BuildStream running on Python = 3.12, BuildStream = 2.3.0 already makes use of the Python tarfile filter functionality, which blocks the symlink escape Users are recommended to upgrade to...

PT-2026-97204

Name of the Vulnerable Software and Affected Versions Apache BuildStream versions prior to 2.8.1 Description An improper link resolution issue exists in the tar source plugin when running on Python versions prior to 3.12. This allows malicious source tarballs to write files on the host system wit...

CVE-2026-82331: Improper Link Resolution Before File Access

Improper link resolution before file access 'link following' vulnerability in the tar source plugin of Apache BuildStream running on Python = 3.12, BuildStream = 2.3.0 already makes use of the Python tarfile filter functionality, which blocks the symlink escape Users are recommended to upgrade to...

Linux Distros Unpatched Vulnerability : CVE-2026-82331

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper link resolution before file access 'link following' vulnerability in the tar source plugin of Apache BuildStream running on Python = 3.12, BuildStream ...