CVE-2026-66486

GNU cpio copies files into or out of a cpio or tar archive. The archive can be another file on the disk, a magnetic tape, or a pipe.

Security Fix(es):

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.

This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30(CVE-2026-66486)

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed. This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.

This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30

• CVE-2026-66485: avoid stack exhaustion from archive-controlled paths
• CVE-2026-66486: quote file names in diagnostics and listings

• CVE-2026-66485: avoid stack exhaustion from archive-controlled paths
• CVE-2026-66486: quote file names in diagnostics and listings

Path Traversal in GNU cpio. (CVE-2026-66484) Uncontrolled Memory Allocation in GNU cpio. (CVE-2026-66485) Improper Output Encoding in GNU cpio. (CVE-2026-66486)

These are all security issues fixed in the cpio-2.15-8.1 package on the GA media of openSUSE Tumbleweed.

This update for cpio fixes the following issues:

• CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended directory via malicious tar archives (bsc#1274856).
• CVE-2026-66485: improper memory management in the make_path function when allocating memory allows for denial of service via crafted archives (bsc#1274857).
• CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality allows for terminal control sequence injection via crafted archive member names (bsc#1274858).

This update for cpio fixes the following issues:

• CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended directory via malicious tar archives (bsc#1274856).
• CVE-2026-66485: improper memory management in the make_path function when allocating memory allows for denial of service via crafted archives (bsc#1274857).
• CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality allows for terminal control sequence injection via crafted archive member names (bsc#1274858).

This update for cpio fixes the following issues:

Security issues fixed:

• CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended directory via malicious tar archives (bsc#1274856).
• CVE-2026-66485: improper memory management in the make_path function when allocating memory allows for denial of service via crafted archives (bsc#1274857).
• CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality allows for terminal control sequence injection via crafted archive member names (bsc#1274858).

Non security issue fixed:

• GCC 14: cpio package fails (bsc#1221712).

This update for cpio fixes the following issues:

• CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended directory via malicious tar archives (bsc#1274856).
• CVE-2026-66485: improper memory management in the make_path function when allocating memory allows for denial of service via crafted archives (bsc#1274857).
• CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality allows for terminal control sequence injection via crafted archive member names (bsc#1274858).

This update for cpio fixes the following issues:

• CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended directory via malicious tar archives (bsc#1274856).
• CVE-2026-66485: improper memory management in the make_path function when allocating memory allows for denial of service via crafted archives (bsc#1274857).
• CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality allows for terminal control sequence injection via crafted archive member names (bsc#1274858).

This update for cpio fixes the following issues:

• CVE-2026-66484: path traversal allows creating hard links outside intended directory via malicious tar archives (bsc#1274856).
• CVE-2026-66485: denial of service via uncontrolled memory allocation from crafted archives (bsc#1274857).
• CVE-2026-66486: terminal control sequence injection via crafted archive member names (bsc#1274858).

This update for cpio fixes the following issues:

• CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended directory via malicious tar archives (bsc#1274856).
• CVE-2026-66485: improper memory management in the make_path function when allocating memory allows for denial of service via crafted archives (bsc#1274857).
• CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality allows for terminal control sequence injection via crafted archive member names (bsc#1274858).

It was discovered that cpio incorrectly sanitized hard-link targets when extracting tar archives in copy-in mode. If a user or automated system were tricked into extracting a specially crafted tar archive, an attacker could possibly use this issue to create hard links to files outside the extraction directory, even when using the --no-absolute-filenames option. (CVE-2026-66484)

It was discovered that cpio did not properly bound the stack memory allocated for pathnames during archive extraction. If a user or automated system were tricked into extracting a specially crafted cpio archive, an attacker could possibly use this issue to cause cpio to crash, resulting in a denial of service. (CVE-2026-66485)

It was discovered that cpio did not properly escape archive member names when listing archive contents. If a user or automated system were tricked into listing a specially crafted archive, an attacker could possibly use this issue to inject misleading output or malicious terminal control sequences. (CVE-2026-66486)