Path Traversal Vulnerability in GNU cpio Affects Archive Extraction
CVE-2026-66484

4.6MEDIUM

Key Information:

Vendor

Gnu
Status
Cpio
Vendor
CVE Published:
10 August 2026

What is CVE-2026-66484?

The GNU cpio tool is susceptible to a Path Traversal vulnerability that arises during the extraction of tar archives. When using the --no-absolute-filenames option, there is an issue where the filename gets normalized, yet the target for a hard-link can be passed without sufficient sanitization. An attacker can exploit this by crafting a tar archive that includes a hard-link entry with an absolute path directed outside the intended extraction directory. This could lead to unintended file linking, thus violating the expected behavior of the extraction process and allowing access to files outside the safe directory structure.

Affected Version(s)

cpio 0 <= 2.15

References

https://cert.pl/en/posts/2026/08/CVE-2026-66484
third-party-advisory
https://git.savannah.gnu.org/cgit/cpio.git
product

CVSS V4

Score:
4.6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michał Majchrowicz (AFINE Team)
Marcin Wyczechowski (AFINE Team)
.