CVE-2026-66484Path Traversal in GNU cpio
Updated under an hour ago ()
Does this affect you?
It affects GNU cpio. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files. This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad
- CVSS
- 4.6 MEDIUM (v4.0, CNA)CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
- Weakness (CWE)
- CWE-22
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- CERT-PL
- NVD analysis
- Deferred
- Record last updated
- Aug 10, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
GNU cpio gnu:cpio (from the name) | through 2.15 | CNA record |
References
- https://cert.pl/en/posts/2026/08/CVE-2026-66484third-party-advisory
- https://git.savannah.gnu.org/cgit/cpio.gitproduct
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.