cpiopwn

cpiopwn CVE-2021-38185 This is an ACE POC of an integer overflow bug in cpio. This exploit bypasses all binary protections except full RELRO. This exploit uses cpio 2.13 and libc 2.31. Video demo: https://youtu.be/F0yKJhu7Vak Running the exploit We've provided a Kali Dockerfile to run the exploit...

cve-2022-41352

cve-2022-41352 generate poc.tar $ chmod +x cpiopocgen.py $ ./cpiopocgen.py show the middle finger to cpio $ cd /tmp $ mkdir -p poc/a/b copy poc.tar to /tmp/poc/a/b/ $ cd /tmp/poc/a/b/ $ cpio -i poc.tar $ ls -al ../ total 16 drwxrwxr-x 3 xabino xabino 4096 ott 10 14:56 . drwxrwxr-x 3 xabino xabino...

cve-2022-41352-zimbra-rce

CVE-2022-41352 Zimbra Unauthenticated RCE CVE-2022-41352 is an arbitrary file write vulnerability in Zimbra mail servers due to the use of a vulnerable cpio version. CVE-2022-41352 NIST.gov CVE-2022-41352 Rapid7 Analysis AffectedZimbra versions: Zimbra 9.0.0.p27 Zimbra 8.8.15.p34 Refer to the pat...

CVE-2026-126831

A flaw was found in cpio. A local user can cause a Denial of Service DoS by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving files owned by users or groups with names exceeding 32 characters, cpio copies these names into fixed-size memory...

CVE-2026-126831

A flaw was found in cpio. A local user can cause a Denial of Service DoS by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving files owned by users or groups with names exceeding 32 characters, cpio copies these names into fixed-size memory...

CVE-2026-126831

A stack-based buffer overflow exists in cpio within the write_out_tar_header() function. The vulnerability occurs when creating archives in tar or ustar formats if the files are owned by users or groups with names exceeding 32 characters. Because the application fails to verify the length of thes...

CVE-2026-126831 Cpio: cpio: stack-based buffer overflow in write_out_tar_header() with long usernames/groupnames

A flaw was found in cpio. A local user can cause a Denial of Service DoS by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving files owned by users or groups with names exceeding 32 characters, cpio copies these names into fixed-size memory...

EUVD-2026-124565

A flaw was found in cpio. A local user can cause a Denial of Service DoS by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving files owned by users or groups with names exceeding 32 characters, cpio copies these names into fixed-size memory...

UBUNTU-CVE-2026-124744

A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outsi...

PT-2026-145908

A flaw was found in cpio. A local user can cause a Denial of Service DoS by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving files owned by users or groups with names exceeding 32 characters, cpio copies these names into fixed-size memory...

CVE-2026-126831: Red Hat: A flaw was found in cpio

A flaw was found in cpio. A local user can cause a Denial of Service DoS by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving files owned by users or groups with names exceeding 32 characters, cpio copies these names into fixed-size memory...

CVE-2026-124744

A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outsi...

SUSE CVE-2026-124744

A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outsi...

CVE-2026-124744

A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outsi...

CVE-2026-124744

A flaw in the BusyBox cpio utility allows for improper sanitization of hardlink target paths even when path traversal protection is enabled. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks pointing outside the intended directory. This vu...

CVE-2026-124744 Busybox: cpio hardlink target not sanitized under feature_path_traversal_protection

A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outsi...

EUVD-2026-123406

A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outsi...

CVE-2026-124744

A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outsi...

CVE-2026-124744

A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outsi...

Zimbra Collaboration - Unrestricted File Upload

An issue was discovered in Zimbra Collaboration ZCS 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole extraction to /opt/zimbra/jetty/webapps/zimbra/public that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also,...