Improper Output Encoding in GNU Cpio Archive Listing Functionality
CVE-2026-66486

4.6MEDIUM

Key Information:

Vendor

Gnu
Status
Cpio
Vendor
CVE Published:
10 August 2026

What is CVE-2026-66486?

GNU Cpio is affected by a vulnerability that allows improper encoding or escaping of output during the archive member listing process. When executing the command 'cpio -it', member names are outputted directly without any quoting or escaping. This weakness can be exploited by an attacker who crafts a malicious cpio archive with member names that include embedded newline characters or ANSI escape sequences. As a result, this can lead to forged listing entries or an injection of terminal control sequences when the listing is displayed.

Affected Version(s)

cpio 0 <= 2.15

References

https://cert.pl/en/posts/2026/08/CVE-2026-66484
third-party-advisory
https://git.savannah.gnu.org/cgit/cpio.git
product

CVSS V4

Score:
4.6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michał Majchrowicz (AFINE Team)
Marcin Wyczechowski (AFINE Team)
.