CVE-2026-66484: Path Traversal in GNU cpio
GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the linktoname function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files.
This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GNU cpioto a version that resolves this vulnerability.Patch e2b9cbdd3354d2b1569b7390d1bc15c1930559ad
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66484?
CVE-2026-66484 is rated with a risk score of 43, indicating a significant vulnerability in GNU cpio.
What does CVE-2026-66484 affect?
CVE-2026-66484 affects the tar archive extraction functionality within GNU cpio.
How does the Path Traversal vulnerability in CVE-2026-66484 exploit systems?
The Path Traversal vulnerability in CVE-2026-66484 allows attackers to manipulate file paths during the extraction of tar archives, potentially leading to unauthorized file access.
How do I fix CVE-2026-66484?
To fix CVE-2026-66484, ensure you update to the latest version of GNU cpio that addresses this vulnerability.
What steps should I take to mitigate the risks associated with CVE-2026-66484?
To mitigate the risks of CVE-2026-66484, avoid using the GNU cpio tool with the --no-absolute-filenames option until the vulnerability is patched.