CVE-2019-14866 Path traversal in cpio

Medium 6.7 Published 7 Jan 2020 Updated 13 Feb 2025

An attacker can craft malicious input to cpio to create TAR archives with unauthorized permissions or paths, leading to system compromise when extracted by a privileged user.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2019-14866?

CVE-2019-14866 is a medium-severity path traversal vulnerability in Redhat Enterprise Linux, published on 7 Jan 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.

Weakness: CWE-20

Which versions are affected by CVE-2019-14866?

It affects 2 products.

Linux distribution packages (24)

`cpio` Red Hat:enterprise_linux:7::client	All versions	`0:2.11-28.el7`
`cpio-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`0:2.11-28.el7`
`cpio` Red Hat:enterprise_linux:7::computenode	All versions	`0:2.11-28.el7`
`cpio-debuginfo` Red Hat:enterprise_linux:7::computenode	All versions	`0:2.11-28.el7`
`cpio` Red Hat:enterprise_linux:7::server	All versions	`0:2.11-28.el7`
`cpio-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:2.11-28.el7`
`cpio` Red Hat:enterprise_linux:7::workstation	All versions	`0:2.11-28.el7`
`cpio-debuginfo` Red Hat:enterprise_linux:7::workstation	All versions	`0:2.11-28.el7`
`cpio` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.12-10.el8`
`cpio-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.12-10.el8`
`cpio-debugsource` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.12-10.el8`
`cpio` Red Hat:rhel_eus:8.2::baseos	All versions	`0:2.12-8.el8_2.1`
`cpio-debuginfo` Red Hat:rhel_eus:8.2::baseos	All versions	`0:2.12-8.el8_2.1`
`cpio-debugsource` Red Hat:rhel_eus:8.2::baseos	All versions	`0:2.12-8.el8_2.1`
`cpio` Rocky Linux:8	All versions	`0:2.12-10.el8`
`cpio` SUSE:Linux Enterprise Desktop 12 SP4	All versions	`2.11-36.6.1`
`cpio` SUSE:Linux Enterprise Module for Basesystem 15	All versions	`2.12-3.3.1`
`cpio` SUSE:Linux Enterprise Module for Basesystem 15 SP1	All versions	`2.12-3.3.1`
`cpio` SUSE:Linux Enterprise Server 12 SP4	All versions	`2.11-36.6.1`
`cpio` SUSE:Linux Enterprise Server 12 SP5	All versions	`2.11-36.6.1`
`cpio` SUSE:Linux Enterprise Server for SAP Applications 12 SP4	All versions	`2.11-36.6.1`
`cpio` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`2.11-36.6.1`
`cpio` openSUSE:Leap 15.0	All versions	`2.12-lp150.2.3.1`
`cpio` openSUSE:Leap 15.1	All versions	`2.12-lp151.3.3.1`

Products include Gnu Cpio, Redhat Enterprise Linux.

How do I fix CVE-2019-14866?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2019-14866 being exploited?

There is no known exploitation of CVE-2019-14866 in the wild and no public exploit code.

All Redhat Enterprise Linux vulnerabilities

Sources

Also known as CLEANSTART-2024-VM66641, DEBIAN-CVE-2019-14866, DLA-1981-1, GHSA-g3pr-277r-xcx7, RHSA-2020:3908, RHSA-2021:1582 and 8 more.