{"id":"CVE-2026-66486","aliases":["AZL-94689","CLSA-2026-1787310466","CLSA-2026-1787337004","DEBIAN-CVE-2026-66486","EUVD-2026-55244","GHSA-p5w5-qcg3-g8gx","MGASA-2026-0435","OESA-2026-3540","SUSE-SU-2026:23355-1","SUSE-SU-2026:23441-1","SUSE-SU-2026:23464-1","SUSE-SU-2026:23612-1","SUSE-SU-2026:3959-1","SUSE-SU-2026:4012-1","UBUNTU-CVE-2026-66486","USN-8704-1","openSUSE-SU-2026:11618-1","openSUSE-SU-2026:21747-1"],"status":"published","title":"Improper Output Encoding in GNU cpio","description":"GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.\n\n\n\n\nThis issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30","severity":{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00184,"percentile":0.08113,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-116"],"published":"2026-08-10T10:25:41Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"cpio","fixed_in":["2.14-2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"cpio","fixed_in":["2.14-6.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"cpio","fixed_in":["2.14-6.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"cpio","fixed_in":["2.14-6.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"cpio","fixed_in":["2.13-10.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"cpio","fixed_in":["2.13-13.oe2203sp4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"cpio","fixed_in":["2.11+dfsg-1ubuntu1.2+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cpio","fixed_in":["2.11+dfsg-5ubuntu1.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cpio","fixed_in":["2.12+dfsg-6ubuntu0.18.04.4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cpio","fixed_in":["2.13+dfsg-2ubuntu0.4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"cpio","fixed_in":["2.13+dfsg-7ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"cpio","fixed_in":["2.15+dfsg-1ubuntu2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"cpio","fixed_in":["2.15+dfsg-2.1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14-2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-16.el9_6.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-16.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.13+dfsg-7.1","2.14+dfsg-1","2.15+dfsg-1","2.15+dfsg-2","2.15+dfsg-2.1"]},{"source":"osv","ecosystem":"Debian:13","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.15+dfsg-2","2.15+dfsg-2.1"]},{"source":"osv","ecosystem":"Debian:14","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.15+dfsg-2","2.15+dfsg-2.1"]},{"source":"osv","ecosystem":"Mageia:10","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15-3.1.mga10"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14-1.1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14-6.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14-6.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14-6.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-10.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-13.oe2203sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15-slfo.1.1_3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15-2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15-160000.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15-160000.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15-160000.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.25.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-150400.3.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-150400.3.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-150400.3.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-150400.3.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11+dfsg-1ubuntu1.2+esm3"}]}],"versions":["2.11+dfsg-1ubuntu1","2.11+dfsg-1ubuntu1.1","2.11+dfsg-1ubuntu1.2","2.11+dfsg-1ubuntu1.2+esm1","2.11+dfsg-1ubuntu1.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11+dfsg-5ubuntu1.1+esm2"}]}],"versions":["2.11+dfsg-4.1ubuntu1","2.11+dfsg-5ubuntu1","2.11+dfsg-5ubuntu1.1","2.11+dfsg-5ubuntu1.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12+dfsg-6ubuntu0.18.04.4+esm1"}]}],"versions":["2.11+dfsg-6","2.12+dfsg-6","2.12+dfsg-6ubuntu0.18.04.1","2.12+dfsg-6ubuntu0.18.04.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13+dfsg-2ubuntu0.4+esm1"}]}],"versions":["2.12+dfsg-9","2.12+dfsg-9ubuntu1","2.13+dfsg-1","2.13+dfsg-2","2.13+dfsg-2ubuntu0.3","2.13+dfsg-2ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13+dfsg-7ubuntu0.2"}]}],"versions":["2.13+dfsg-4ubuntu4","2.13+dfsg-7","2.13+dfsg-7ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15+dfsg-1ubuntu2.1"}]}],"versions":["2.13+dfsg-7.1","2.14+dfsg-1","2.15+dfsg-1","2.15+dfsg-1ubuntu1","2.15+dfsg-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15+dfsg-2.1ubuntu0.1"}]}],"versions":["2.15+dfsg-2ubuntu1","2.15+dfsg-2.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11+dfsg-1ubuntu1.2+esm3"}]}],"versions":["2.11+dfsg-1ubuntu1","2.11+dfsg-1ubuntu1.1","2.11+dfsg-1ubuntu1.2","2.11+dfsg-1ubuntu1.2+esm1","2.11+dfsg-1ubuntu1.2+esm2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11+dfsg-5ubuntu1.1+esm2"}]}],"versions":["2.11+dfsg-4.1ubuntu1","2.11+dfsg-5ubuntu1","2.11+dfsg-5ubuntu1.1","2.11+dfsg-5ubuntu1.1+esm1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12+dfsg-6ubuntu0.18.04.4+esm1"}]}],"versions":["2.11+dfsg-6","2.12+dfsg-6","2.12+dfsg-6ubuntu0.18.04.1","2.12+dfsg-6ubuntu0.18.04.4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13+dfsg-2ubuntu0.4+esm1"}]}],"versions":["2.12+dfsg-9","2.12+dfsg-9ubuntu1","2.13+dfsg-1","2.13+dfsg-2","2.13+dfsg-2ubuntu0.3","2.13+dfsg-2ubuntu0.4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13+dfsg-7ubuntu0.2"}]}],"versions":["2.13+dfsg-4ubuntu4","2.13+dfsg-7","2.13+dfsg-7ubuntu0.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15+dfsg-1ubuntu2.1"}]}],"versions":["2.13+dfsg-7.1","2.14+dfsg-1","2.15+dfsg-1","2.15+dfsg-1ubuntu1","2.15+dfsg-1ubuntu2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15+dfsg-2.1ubuntu0.1"}]}],"versions":["2.15+dfsg-2ubuntu1","2.15+dfsg-2.1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15-8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15-160000.3.1"}]}],"bundled":3}],"products":[{"vendor":"gnu","product":"cpio"},{"vendor":"red hat","product":"cpio"}],"references":[{"url":"https://cert.pl/en/posts/2026/08/CVE-2026-66484","tags":["third-party-advisory","advisory","report"]},{"url":"https://git.savannah.gnu.org/cgit/cpio.git","tags":["product","package","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66486","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-p5w5-qcg3-g8gx"},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1787310466.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66485","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1787337004.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66486.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-66486","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0435.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36242","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8704-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3540","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623355-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1274856","tags":["report"]},{"url":"https://bugzilla.suse.com/1274857","tags":["report"]},{"url":"https://bugzilla.suse.com/1274858","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66485","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66486","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623441-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1221712","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623464-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623612-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263959-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264012-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-66486","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-66486","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-66484","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-66485","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-66486","title":"Improper Output Encoding in GNU cpio","description":"GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.\n\n\n\n\nThis issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30","status":"published","published":"2026-08-10T10:25:41.625Z","modified":"2026-08-10T10:35:09.032Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:20:12.939084Z"}],"euvd":[{"id":"EUVD-2026-55244","description":"GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.\n\n\n\n\nThis issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30","status":"published","published":"2026-08-10T10:25:41Z","modified":"2026-08-10T10:35:09Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:02:06.086083Z"}],"ghsa":[{"id":"GHSA-p5w5-qcg3-g8gx","title":"GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing...","description":"GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.\n\n\n\n\nThis issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30","status":"published","published":"2026-08-10T12:31:50Z","modified":"2026-08-10T12:31:54Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T15:10:13.54571Z"}],"nvd":[{"id":"CVE-2026-66486","description":"GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.\n\n\n\n\nThis issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30","status":"published","published":"2026-08-10T11:17:27.907Z","modified":"2026-10-24T16:10:00.153Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:12:35.743275Z"}],"osv":[{"id":"CVE-2026-66486","title":"Improper Output Encoding in GNU cpio","description":"GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.\n\n\n\n\nThis issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30","status":"published","published":"2026-08-10T10:25:41.625Z","modified":"2026-10-25T02:30:17.175954106Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T15:45:14.46177Z"},{"id":"DEBIAN-CVE-2026-66486","description":"GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.     This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30","status":"published","published":"2026-08-10T11:17:27.907Z","modified":"2026-10-25T09:47:32.326937213Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:58.699079Z"},{"id":"OESA-2026-3540","title":"cpio security update","description":"GNU cpio copies files into or out of a cpio or tar archive. The archive can be another file on the disk, a magnetic tape, or a pipe.\r\n\r\nSecurity Fix(es):\n\nGNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.\n\n\n\n\nThis issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30(CVE-2026-66486)","status":"published","published":"2026-08-30T04:15:34Z","modified":"2026-08-30T04:31:11.393898985Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"UBUNTU-CVE-2026-66486","description":"GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed. This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30","status":"published","published":"2026-08-10T11:17:00Z","modified":"2026-09-01T15:47:52.109759277Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:53.710209Z"},{"id":"AZL-94689","title":"CVE-2026-66486 affecting package cpio for versions less than 2.14-2","description":"GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.\n\n\n\n\nThis issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30","status":"published","published":"2026-08-10T11:17:27Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"CLSA-2026-1787310466","title":"cpio: Fix of 2 CVEs","description":"- CVE-2026-66485: avoid stack exhaustion from archive-controlled paths\n- CVE-2026-66486: quote file names in diagnostics and listings","status":"published","published":"2026-08-21T11:08:04Z","modified":"2026-10-26T09:31:28.906636276Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787337004","title":"cpio: Fix of 2 CVEs","description":"- CVE-2026-66485: avoid stack exhaustion from archive-controlled paths\n- CVE-2026-66486: quote file names in diagnostics and listings","status":"published","published":"2026-08-21T18:30:16Z","modified":"2026-10-26T09:30:37.698699332Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"MGASA-2026-0435","title":"Updated cpio packages fix security vulnerabilities","description":"Path Traversal in GNU cpio. (CVE-2026-66484)\nUncontrolled Memory Allocation in GNU cpio. (CVE-2026-66485)\nImproper Output Encoding in GNU cpio. (CVE-2026-66486)\n","status":"published","published":"2026-09-23T01:45:55Z","modified":"2026-09-23T02:00:08.323135269Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11618-1","title":"cpio-2.15-8.1 on GA media","description":"These are all security issues fixed in the cpio-2.15-8.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-27T00:00:00Z","modified":"2026-08-28T18:23:08.633900665Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21747-1","title":"Security update for cpio","description":"This update for cpio fixes the following issues:\n\n- CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard\n  links outside intended directory via malicious tar archives (bsc#1274856).\n- CVE-2026-66485: improper memory management in the `make_path` function when allocating memory allows for denial of\n  service via crafted archives (bsc#1274857).\n- CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality allows for\n  terminal control sequence injection via crafted archive member names (bsc#1274858).\n","status":"published","published":"2026-09-03T14:47:52Z","modified":"2026-09-09T18:23:13.642681083Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23355-1","title":"Security update for cpio","description":"This update for cpio fixes the following issues:\n\n- CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard\n  links outside intended directory via malicious tar archives (bsc#1274856).\n- CVE-2026-66485: improper memory management in the `make_path` function when allocating memory allows for denial of\n  service via crafted archives (bsc#1274857).\n- CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality allows for\n  terminal control sequence injection via crafted archive member names (bsc#1274858).\n","status":"published","published":"2026-08-28T11:00:05Z","modified":"2026-09-10T18:23:12.505259654Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23441-1","title":"Security update for cpio","description":"This update for cpio fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard\n  links outside intended directory via malicious tar archives (bsc#1274856).\n- CVE-2026-66485: improper memory management in the `make_path` function when allocating memory allows for denial of\n  service via crafted archives (bsc#1274857).\n- CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality allows for\n  terminal control sequence injection via crafted archive member names (bsc#1274858).\n\nNon security issue fixed:\n\n- GCC 14: cpio package fails (bsc#1221712).\n\n","status":"published","published":"2026-08-31T19:29:34Z","modified":"2026-09-14T18:23:11.006889794Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23464-1","title":"Security update for cpio","description":"This update for cpio fixes the following issues:\n\n- CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard\n  links outside intended directory via malicious tar archives (bsc#1274856).\n- CVE-2026-66485: improper memory management in the `make_path` function when allocating memory allows for denial of\n  service via crafted archives (bsc#1274857).\n- CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality allows for\n  terminal control sequence injection via crafted archive member names (bsc#1274858).\n","status":"published","published":"2026-09-03T14:49:10Z","modified":"2026-09-14T18:23:12.172147103Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23612-1","title":"Security update for cpio","description":"This update for cpio fixes the following issues:\n\n- CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard\n  links outside intended directory via malicious tar archives (bsc#1274856).\n- CVE-2026-66485: improper memory management in the `make_path` function when allocating memory allows for denial of\n  service via crafted archives (bsc#1274857).\n- CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality allows for\n  terminal control sequence injection via crafted archive member names (bsc#1274858).\n","status":"published","published":"2026-09-03T14:49:10Z","modified":"2026-09-29T18:23:19.208734127Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:3959-1","title":"Security update for cpio","description":"This update for cpio fixes the following issues:\n\n- CVE-2026-66484: path traversal allows creating hard links outside intended directory via malicious tar archives\n  (bsc#1274856).\n- CVE-2026-66485: denial of service via uncontrolled memory allocation from crafted archives (bsc#1274857).\n- CVE-2026-66486: terminal control sequence injection via crafted archive member names (bsc#1274858).\n","status":"published","published":"2026-09-03T13:32:22Z","modified":"2026-09-13T18:23:12.437666635Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4012-1","title":"Security update for cpio","description":"This update for cpio fixes the following issues:\n\n- CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard\n  links outside intended directory via malicious tar archives (bsc#1274856).\n- CVE-2026-66485: improper memory management in the `make_path` function when allocating memory allows for denial of\n  service via crafted archives (bsc#1274857).\n- CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality allows for\n  terminal control sequence injection via crafted archive member names (bsc#1274858).\n","status":"published","published":"2026-09-07T07:34:54Z","modified":"2026-09-13T18:23:15.156312136Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8704-1","title":"cpio vulnerabilities","description":"It was discovered that cpio incorrectly sanitized hard-link targets when\nextracting tar archives in copy-in mode. If a user or automated system\nwere tricked into extracting a specially crafted tar archive, an attacker\ncould possibly use this issue to create hard links to files outside the\nextraction directory, even when using the --no-absolute-filenames option.\n(CVE-2026-66484)\n\nIt was discovered that cpio did not properly bound the stack memory\nallocated for pathnames during archive extraction. If a user or automated\nsystem were tricked into extracting a specially crafted cpio archive, an\nattacker could possibly use this issue to cause cpio to crash, resulting\nin a denial of service. (CVE-2026-66485)\n\nIt was discovered that cpio did not properly escape archive member names\nwhen listing archive contents. If a user or automated system were tricked\ninto listing a specially crafted archive, an attacker could possibly use\nthis issue to inject misleading output or malicious terminal control\nsequences. (CVE-2026-66486)","status":"published","published":"2026-08-31T13:12:09Z","modified":"2026-09-01T15:56:17.78869085Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}