CVE-2026-66484

A flaw was found in GNU cpio. This vulnerability, known as Path Traversal, occurs during the extraction of tar archives in copy-in mode when the --no-absolute-filenames option is used. A remote attacker could craft a malicious tar archive containing a hard-link entry with an absolute path. This could allow cpio to create a hard link to an existing file outside the intended extraction directory, bypassing security controls and potentially leading to unauthorized file system modifications.

A path traversal flaw was found in GNU cpio. When extracting tar archives in copy-in mode with the --no-absolute-filenames option, the hard-link target name is not sanitized. An attacker could provide a specially crafted tar archive that, when extracted with this option, creates hard links pointing to files outside the intended extraction directory, potentially leading to unauthorized file modifications.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid using the --no-absolute-filenames option when extracting untrusted archives with cpio.