USN-8704-1 cpio vulnerabilities

It was discovered that cpio incorrectly sanitized hard-link targets when extracting tar archives in copy-in mode. If a user or automated system were tricked into extracting a specially crafted tar archive, an attacker could possibly use this issue to create hard links to files outside the...

cpio: GNU cpio: Path Traversal allows creating hard links outside intended directory via malicious tar archives.

A flaw was found in GNU cpio. This vulnerability, known as Path Traversal, occurs during the extraction of tar archives in copy-in mode when the --no-absolute-filenames option is used. A remote attacker could craft a malicious tar archive containing a hard-link entry with an absolute path. This...

SUSE CVE-2026-66484

GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the linktoname function without...

CVE-2026-66484

A flaw was found in GNU cpio. This vulnerability, known as Path Traversal, occurs during the extraction of tar archives in copy-in mode when the --no-absolute-filenames option is used. A remote attacker could craft a malicious tar archive containing a hard-link entry with an absolute path. This...

AZL-94695 CVE-2026-66484 affecting package cpio for versions less than 2.14-2

GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the linktoname function without...

DEBIAN-CVE-2026-66484

GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the linktoname function without...

CVE-2026-66484 Path Traversal in GNU cpio

GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the linktoname function without...

CVE-2026-66484

GNU cpio has a Path Traversal vulnerability in tar extraction (copy-in mode with --no-absolute-filenames). A tar archive with a hard-link entry whose linkname is an absolute path can cause a hard link to a file outside the extraction directory because the hard-link target is passed to link_to_nam...

CVE-2026-66484

GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the linktoname function without...

PT-2026-69440

Name of the Vulnerable Software and Affected Versions GNU cpio affected versions not specified Description Path Traversal exists in the tar archive extraction functionality. When extracting a tar archive in copy-in mode using the --no-absolute-filenames option, the extracted file name is...