Read the docs
TI-2026-47233 Aliases CVE-2026-66484GHSA-rc3p-p5w3-fm9j

Path Traversal in GNU cpio

Priority LOW 21CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 1 fixed, 5 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files. This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00197 9th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GNUcpioup to 2.15—No fix listedCNA
  • cpio VendorGNU Affected up to 2.15 Fixed in — No fix listed CNA

Remediation

Red Hat 1 advisory

  • RHSA-2026:54508 Released 2026-08-13 · Red Hat rating Low
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images cpio-2.15-10.1.hum1@aarch64, cpio-2.15-10.1.hum1@src, cpio-2.15-10.1.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 6AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:54508

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-66484
  2. 2026-10-03 Alias added: GHSA-rc3p-p5w3-fm9j

References

Advisory 1

Other 1

  • TI-2026-19388 telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root"… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05164 GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the… KEVCVSS 3.1HIGH 8.8
  • TI-2023-04522 Glibc: buffer overflow in ld.so leading to privilege escalation KEVCVSS 3.1HIGH 7.8
  • TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
See all 1272 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences