TI-2023-06592 Aliases CVE-2023-7207 GHSA-x4gq-xcr8-xwp7

Path traversal in Debian cpio

LOW 24CWE-22Published 2024-01-05 · Updated 2025-05-07

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Partial Red Hat: 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-22 and the CVSS impact.

Summary

Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a regression in --no-absolute-filenames. Upstream has since provided a proper fix to --no-absolute-filenames.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00914 60th percentileScored 2026-11-07

Fix Partial Debian cpio (Debian): 2.14+dfsg-1Red Hat: 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Debian	Debian cpio	before 2.14+dfsg-1	2.14+dfsg-1	Patch available	CNA

Debian cpio VendorDebian Affected before 2.14+dfsg-1 Fixed in 2.14+dfsg-1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:gnu:cpio:2.13:::::::*	2.13	Vulnerable	GNU

cpe:2.3:a:gnu:cpio:2.13:*:*:*:*:*:*:* Versions 2.13 Vulnerable ·GNU

Remediation

Fix · CNA Debian cpio (Debian) Fixed in 2.14+dfsg-1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 8	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux 9	Affected	No fix planned: Will not fix

Timeline

2026-10-02 Threatist record created from CVE-2023-7207
2026-10-03 Alias added: GHSA-x4gq-xcr8-xwp7

References

Patch 1

https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=376d663340a9dc91c91a5849e5713f07571c1628

Advisory 1

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-7207

Other 3

TI-2026-19388 telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root"… KEVCVSS 3.1CRITICAL 9.8
TI-2025-31204 Deserialization of untrusted data in Roundcube Webmail KEVCVSS 3.1CRITICAL 9.9
TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
TI-2025-23504 Erlang/OTP SSH Vulnerable to Pre-Authentication RCE KEVCVSS 3.1CRITICAL 10.0
TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
TI-2025-17951 Out-of-bounds write in Apple Safari KEVCVSS 3.1CRITICAL 10.0

See all 10170 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences