Hi, The following vulnerabilities were published for cpio. CVE-2026-66484[0]: | GNU cpio contains a Path Traversal vulnerability in its tar archive | extraction functionality. When extracting a tar archive in copy-in | mode with the --no-absolute-filenames option, the extracted file | name is normalized but the tar hard-link target is passed to the | link_to_name function without equivalent sanitization before calling | link function. A tar archive provided by an attacker, containing a | hard-link entry whose linkname is set to an absolute path outside | the extraction directory, can cause cpio to create a hard link to an | existing file outside the intended extraction directory, breaking | the expected guarantee of --no-absolute-filenames and allowing | archive-controlled linkage to external files. This issue has been | fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad CVE-2026-66485[1]: | GNU cpio is vulnerable to an uncontrolled memory allocation in the | make_path function at src/makepath.c. The function uses alloca to | allocate stack memory based on the length of argpath, which is | derived from an archive-controlled pathname during extraction. A | malicious cpio archive containing a sufficiently long nested | pathname causes an unbounded stack allocation, resulting in a stack | overflow and crash of the cpio process. An attacker who can supply a | crafted cpio archive to a victim who extracts it can cause a denial | of service. This issue has been fixed in commit | 3cd514031371d8aeeaf2048aa10103e02831aaa9 CVE-2026-66486[2]: | GNU cpio is vulnerable to improper encoding or escaping of output in | its archive member listing functionality. When listing archive | members via cpio -it, member names are printed directly to output | without quoting or escaping. An attacker can craft a cpio archive | containing member names with embedded newline characters or ANSI | escape sequences, causing forged listing entries or terminal control | sequence injection when the listing is displayed. This issue has | been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30 If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-66484 https://www.cve.org/CVERecord?id=CVE-2026-66484 [1] https://security-tracker.debian.org/tracker/CVE-2026-66485 https://www.cve.org/CVERecord?id=CVE-2026-66485 [2] https://security-tracker.debian.org/tracker/CVE-2026-66486 https://www.cve.org/CVERecord?id=CVE-2026-66486 Regards, Salvatore