AUGUST 15, 2026
Live Feed
Back to database
Case File

CVE-2026-66484

MEDIUM · CVSS 4.6 EPSS 0.16%

Source: NVD + CISA KEV + EPSS · Published 2026-08-10 · Last synced 2026-08-15

CyberRota Analysis

AI-Generated

GNU cpio is vulnerable to a Path Traversal issue that arises during the extraction of tar archives, specifically when using the --no-absolute-filenames option. An attacker can exploit this vulnerability by crafting a tar archive that includes a hard-link entry pointing to an absolute path outside the designated extraction directory, potentially allowing unauthorized access to files outside the intended scope. Organizations using GNU cpio for handling tar archives should prioritize patching this vulnerability to prevent potential exploitation.

CVE
CVE-2026-66484
Severity
MEDIUM
CVSS
4.6
EPSS
0.16%

Original NVD Description

GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files. This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad