CVE-2026-66484
Received Received - Intake

Path Traversal via Hard-Link in GNU cpio

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: CERT.PL

Description
GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files. This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-66484
EUVD
EUVD-2026-55256

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
gnu cpio to e2b9cbdd3354d2b1569b7390d1bc15c1930559ad (inc)
gnu cpio to commit_e2b9cbdd3354d2b1569b7390d1bc15c1930559ad (inc)
gnu cpio *
gnu cpio From 2.11.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GNU cpio has a Path Traversal vulnerability in tar archive extraction. When using copy-in mode with --no-absolute-filenames, hard-link targets are not properly sanitized. An attacker can create a tar archive with a hard-link entry pointing to an absolute path outside the extraction directory. This allows cpio to create a hard link to an existing file outside the intended directory, bypassing the --no-absolute-filenames safeguard.

Detection Guidance

To detect this vulnerability, check if your system uses a vulnerable version of GNU cpio by running: cpio --version. If the version is before the fixed commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad, it is vulnerable. Additionally, inspect tar archives for hard-link entries with absolute paths using: tar -tvf archive.tar | grep '^h'

Impact Analysis

This vulnerability could allow an attacker to overwrite or link to sensitive files outside the intended extraction directory. If exploited, it may lead to unauthorized file access, data corruption, or system compromise, depending on the permissions of the targeted files.

Compliance Impact

This vulnerability could potentially violate compliance with standards like GDPR or HIPAA by allowing unauthorized file access or modification outside intended directories. By enabling hard-link creation to external files, attackers might bypass access controls or exfiltrate sensitive data, undermining data integrity and confidentiality requirements.

Mitigation Strategies

Update GNU cpio to the fixed version in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad or later to address the path traversal issue in tar archive extraction.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66484. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart