CVE-2026-66484 Path Traversal in GNU cpio
Attackers can create hard links to external files during tar extraction, bypassing security restrictions in GNU cpio.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-66484?
CVE-2026-66484 is a medium-severity path traversal vulnerability in GNU cpio, published on 10 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files.
This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad
Weakness: CWE-22
Which versions are affected by CVE-2026-66484?
Linux distribution packages (1)
cpio Red Hat:hummingbird:1 | All versions | 0:2.15-10.1.hum1 |
How do I fix CVE-2026-66484?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-66484 being exploited?
There is no known exploitation of CVE-2026-66484 in the wild and no public exploit code.
Sources
Also known as AZL-94695, DEBIAN-CVE-2026-66484, GHSA-rc3p-p5w3-fm9j, RHSA-2026:54508, UBUNTU-CVE-2026-66484.