CVE-2026-66485

GNU cpio copies files into or out of a cpio or tar archive. The archive can be another file on the disk, a magnetic tape, or a pipe.

Security Fix(es):

GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files.

This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad(CVE-2026-66484)

GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service.

This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9(CVE-2026-66485)

GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9

GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service.

This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9

• CVE-2026-66485: avoid stack exhaustion from archive-controlled paths
• CVE-2026-66486: quote file names in diagnostics and listings

• CVE-2026-66485: avoid stack exhaustion from archive-controlled paths
• CVE-2026-66486: quote file names in diagnostics and listings

Path Traversal in GNU cpio. (CVE-2026-66484) Uncontrolled Memory Allocation in GNU cpio. (CVE-2026-66485) Improper Output Encoding in GNU cpio. (CVE-2026-66486)

These are all security issues fixed in the cpio-2.15-8.1 package on the GA media of openSUSE Tumbleweed.

This update for cpio fixes the following issues:

• CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended directory via malicious tar archives (bsc#1274856).
• CVE-2026-66485: improper memory management in the make_path function when allocating memory allows for denial of service via crafted archives (bsc#1274857).
• CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality allows for terminal control sequence injection via crafted archive member names (bsc#1274858).

This update for cpio fixes the following issues:

• CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended directory via malicious tar archives (bsc#1274856).
• CVE-2026-66485: improper memory management in the make_path function when allocating memory allows for denial of service via crafted archives (bsc#1274857).
• CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality allows for terminal control sequence injection via crafted archive member names (bsc#1274858).

This update for cpio fixes the following issues:

Security issues fixed:

• CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended directory via malicious tar archives (bsc#1274856).
• CVE-2026-66485: improper memory management in the make_path function when allocating memory allows for denial of service via crafted archives (bsc#1274857).
• CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality allows for terminal control sequence injection via crafted archive member names (bsc#1274858).

Non security issue fixed:

• GCC 14: cpio package fails (bsc#1221712).

This update for cpio fixes the following issues:

• CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended directory via malicious tar archives (bsc#1274856).
• CVE-2026-66485: improper memory management in the make_path function when allocating memory allows for denial of service via crafted archives (bsc#1274857).
• CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality allows for terminal control sequence injection via crafted archive member names (bsc#1274858).

This update for cpio fixes the following issues:

• CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended directory via malicious tar archives (bsc#1274856).
• CVE-2026-66485: improper memory management in the make_path function when allocating memory allows for denial of service via crafted archives (bsc#1274857).
• CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality allows for terminal control sequence injection via crafted archive member names (bsc#1274858).

This update for cpio fixes the following issues:

• CVE-2026-66484: path traversal allows creating hard links outside intended directory via malicious tar archives (bsc#1274856).
• CVE-2026-66485: denial of service via uncontrolled memory allocation from crafted archives (bsc#1274857).
• CVE-2026-66486: terminal control sequence injection via crafted archive member names (bsc#1274858).

This update for cpio fixes the following issues:

• CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended directory via malicious tar archives (bsc#1274856).
• CVE-2026-66485: improper memory management in the make_path function when allocating memory allows for denial of service via crafted archives (bsc#1274857).
• CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality allows for terminal control sequence injection via crafted archive member names (bsc#1274858).

It was discovered that cpio incorrectly sanitized hard-link targets when extracting tar archives in copy-in mode. If a user or automated system were tricked into extracting a specially crafted tar archive, an attacker could possibly use this issue to create hard links to files outside the extraction directory, even when using the --no-absolute-filenames option. (CVE-2026-66484)

It was discovered that cpio did not properly bound the stack memory allocated for pathnames during archive extraction. If a user or automated system were tricked into extracting a specially crafted cpio archive, an attacker could possibly use this issue to cause cpio to crash, resulting in a denial of service. (CVE-2026-66485)

It was discovered that cpio did not properly escape archive member names when listing archive contents. If a user or automated system were tricked into listing a specially crafted archive, an attacker could possibly use this issue to inject misleading output or malicious terminal control sequences. (CVE-2026-66486)