CVE-2026-66484

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-66484", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2026-07-27T11:32:08.682Z", "datePublished": "2026-08-10T10:25:27.901Z", "dateUpdated": "2026-08-10T10:57:14.423Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-08-10T10:25:27.901Z"}, "title": "Path Traversal in GNU cpio", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "affected": [{"vendor": "GNU", "product": "cpio", "repo": "https://git.savannah.gnu.org/cgit/cpio.git", "programFiles": ["tar.c"], "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "2.15", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndIncluding": "2.15"}]}]}], "descriptions": [{"lang": "en", "value": "GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files.\n\nThis issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad", "supportingMedia": [{"type": "text/html", "base64": false, "value": "GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files.<br><br>This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad"}]}], "tags": ["x_open-source"], "references": [{"url": "https://cert.pl/en/posts/2026/08/CVE-2026-66484", "tags": ["third-party-advisory"]}, {"url": "https://git.savannah.gnu.org/cgit/cpio.git", "tags": ["product"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 4.6, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N"}}], "credits": [{"lang": "en", "value": "Micha\u0142 Majchrowicz (AFINE Team)", "type": "finder"}, {"lang": "en", "value": "Marcin Wyczechowski (AFINE Team)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-10T10:57:05.821880Z", "id": "CVE-2026-66484", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T10:57:14.423Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-66484", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-10T10:57:05.821880Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T10:57:10.205Z"}}], "cna": {"tags": ["x_open-source"], "title": "Path Traversal in GNU cpio", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Micha\u0142 Majchrowicz (AFINE Team)"}, {"lang": "en", "type": "finder", "value": "Marcin Wyczechowski (AFINE Team)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.6, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://git.savannah.gnu.org/cgit/cpio.git", "vendor": "GNU", "product": "cpio", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.15"}], "programFiles": ["tar.c"], "defaultStatus": "unaffected"}], "references": [{"url": "https://cert.pl/en/posts/2026/08/CVE-2026-66484", "tags": ["third-party-advisory"]}, {"url": "https://git.savannah.gnu.org/cgit/cpio.git", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files.\n\nThis issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad", "supportingMedia": [{"type": "text/html", "value": "GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files.<br><br>This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "2.15", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-08-10T10:25:27.901Z"}}}, "cveMetadata": {"cveId": "CVE-2026-66484", "state": "PUBLISHED", "dateUpdated": "2026-08-10T10:57:14.423Z", "dateReserved": "2026-07-27T11:32:08.682Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-08-10T10:25:27.901Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "cpio", "programFiles": ["tar.c"], "repo": "https://git.savannah.gnu.org/cgit/cpio.git", "vendor": "GNU", "versions": [{"lessThanOrEqual": "2.15", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "cvd@cert.pl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files.\n\nThis issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad"}, {"lang": "es", "value": "GNU cpio contiene una vulnerabilidad de salto de ruta en su funcionalidad de extracci\u00f3n de archivos tar. Al extraer un archivo tar en modo de copia de entrada (copy-in mode) con la opci\u00f3n --no-absolute-filenames, el nombre del archivo extra\u00eddo se normaliza, pero el objetivo del enlace duro (hard-link target) de tar se pasa a la funci\u00f3n link_to_name sin una sanitizaci\u00f3n equivalente antes de llamar a la funci\u00f3n link. Un archivo tar proporcionado por un atacante, que contiene una entrada de enlace duro (hard-link entry) cuyo linkname est\u00e1 configurado a una ruta absoluta fuera del directorio de extracci\u00f3n, puede hacer que cpio cree un enlace duro a un archivo existente fuera del directorio de extracci\u00f3n previsto, rompiendo la garant\u00eda esperada de --no-absolute-filenames y permitiendo el enlace controlado por el archivo a archivos externos.\n\nEste problema ha sido solucionado en el commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad"}], "id": "CVE-2026-66484", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66484", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-10T10:57:05.821880Z", "version": "2.0.3"}}]}, "published": "2026-08-10T11:17:27.620", "references": [{"source": "cvd@cert.pl", "url": "https://cert.pl/en/posts/2026/08/CVE-2026-66484"}, {"source": "cvd@cert.pl", "url": "https://git.savannah.gnu.org/cgit/cpio.git"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{"bugzilla": {"description": "cpio: GNU cpio: Path Traversal allows creating hard links outside intended directory via malicious tar archives.", "id": "2513087", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513087"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-22", "details": ["GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files.\nThis issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad", "A flaw was found in GNU cpio. This vulnerability, known as Path Traversal, occurs during the extraction of tar archives in copy-in mode when the `--no-absolute-filenames` option is used. A remote attacker could craft a malicious tar archive containing a hard-link entry with an absolute path. This could allow cpio to create a hard link to an existing file outside the intended extraction directory, bypassing security controls and potentially leading to unauthorized file system modifications."], "mitigation": {"lang": "en:us", "value": "Avoid using the --no-absolute-filenames option when extracting untrusted archives with cpio."}, "name": "CVE-2026-66484", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "cpio", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Fix deferred", "package_name": "cpio", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "cpio", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "cpio", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "cpio", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "cpio", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-08-10T10:25:27Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-66484\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-66484\nhttps://cert.pl/en/posts/2026/08/CVE-2026-66484\nhttps://git.savannah.gnu.org/cgit/cpio.git"], "statement": "A path traversal flaw was found in GNU cpio. When extracting tar archives in copy-in mode with the --no-absolute-filenames option, the hard-link target name is not sanitized. An attacker could provide a specially crafted tar archive that, when extracted with this option, creates hard links pointing to files outside the intended extraction directory, potentially leading to unauthorized file modifications.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.15]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "cpio", "source": "cna", "vendor": "GNU"}, "product": "cpio", "vendor": "gnu"}], "created": "2026-08-10T11:30:16.036500+00:00", "updated": "2026-08-10T11:30:16.132588+00:00", "vendors": ["gnu", "gnu$PRODUCT$cpio"]}