#1144387 cpio: CVE-2026-66484 CVE-2026-66485 CVE-2026-66486

Package:
src:cpio
Source:
src:cpio
Submitter:
Salvatore Bonaccorso
Date:
2026-08-14 14:29:02 UTC
Severity:
normal
Tags:
#1144387#5
Date:
2026-08-14 14:27:13 UTC
From:
To:
Hi,

The following vulnerabilities were published for cpio.

CVE-2026-66484[0]:
| GNU cpio contains a Path Traversal vulnerability in its tar archive
| extraction functionality. When extracting a tar archive in copy-in
| mode with the --no-absolute-filenames option, the extracted file
| name is normalized but the tar hard-link target is passed to the
| link_to_name function without equivalent sanitization before calling
| link function. A tar archive provided by an attacker, containing a
| hard-link entry whose linkname is set to an absolute path outside
| the extraction directory, can cause cpio to create a hard link to an
| existing file outside the intended extraction directory, breaking
| the expected guarantee of --no-absolute-filenames and allowing
| archive-controlled linkage to external files.  This issue has been
| fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad


CVE-2026-66485[1]:
| GNU cpio is vulnerable to an uncontrolled memory allocation in the
| make_path function at src/makepath.c. The function uses alloca to
| allocate stack memory based on the length of argpath, which is
| derived from an archive-controlled pathname during extraction. A
| malicious cpio archive containing a sufficiently long nested
| pathname causes an unbounded stack allocation, resulting in a stack
| overflow and crash of the cpio process. An attacker who can supply a
| crafted cpio archive to a victim who extracts it can cause a denial
| of service.  This issue has been fixed in commit
| 3cd514031371d8aeeaf2048aa10103e02831aaa9


CVE-2026-66486[2]:
| GNU cpio is vulnerable to improper encoding or escaping of output in
| its archive member listing functionality. When listing archive
| members via cpio -it, member names are printed directly to output
| without quoting or escaping. An attacker can craft a cpio archive
| containing member names with embedded newline characters or ANSI
| escape sequences, causing forged listing entries or terminal control
| sequence injection when the listing is displayed.     This issue has
| been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-66484
https://www.cve.org/CVERecord?id=CVE-2026-66484
[1] https://security-tracker.debian.org/tracker/CVE-2026-66485
https://www.cve.org/CVERecord?id=CVE-2026-66485
[2] https://security-tracker.debian.org/tracker/CVE-2026-66486
https://www.cve.org/CVERecord?id=CVE-2026-66486

Regards,
Salvatore