CVE-2026-66484 in Cpio
Summary
by MITRE • 08/10/2026
GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files.
This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The GNU cpio utility suffers from a path traversal vulnerability within its tar archive extraction capabilities that fundamentally undermines the security guarantees provided by the --no-absolute-filenames option. This vulnerability resides in the copy-in mode processing where the software normalizes extracted filenames but fails to apply equivalent sanitization to hard-link targets, creating a dangerous disparity in input validation mechanisms.
The technical flaw manifests when cpio processes tar archives containing hard-link entries with absolute paths in their linkname fields. While the extraction routine properly normalizes regular filenames to prevent directory traversal attacks, the hard-link target processing bypasses this critical sanitization step. The link_to_name function receives unvalidated absolute paths directly from the tar archive and passes them to the system link function without any path validation or sanitization.
This vulnerability directly maps to CWE-22 Path Traversal and CWE-352 Cross-Site Request Forgery, as it allows attackers to manipulate file system links beyond the intended extraction boundaries. The flaw enables attackers to create hard links between files within the target directory and existing files outside of it, potentially resulting in privilege escalation or data corruption scenarios. The security boundary established by --no-absolute-filenames is completely subverted, allowing arbitrary file linkage operations.
The operational impact of this vulnerability extends beyond simple path traversal as it creates persistent link relationships that can be exploited for privilege escalation attacks. When an attacker crafts a malicious tar archive containing hard-link entries with absolute paths pointing to system-critical files, they can establish links to existing files outside the extraction directory. This enables them to modify or corrupt files that should normally remain isolated from the extraction process.
Mitigation strategies must include immediate patch application addressing commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad which implements proper sanitization of hard-link targets. Additionally, administrators should avoid processing untrusted tar archives with cpio, particularly in privileged contexts where the extraction directory may contain sensitive system files. System hardening measures should include restricting cpio execution permissions and implementing proper input validation at all levels of archive processing.
The vulnerability demonstrates a classic security principle failure where partial input sanitization creates an attack surface through inconsistent validation mechanisms. This represents a significant concern for systems using cpio in automated environments or those processing untrusted archives, as the flaw can be exploited without requiring special privileges beyond archive creation capabilities. The ATT&CK framework categorizes this under T1059 Command and Scripting Interpreter and T1566 Phishing with Malicious Attachments, as attackers can leverage this vulnerability through malicious archive delivery mechanisms.
Defense in depth approaches should include monitoring for unusual hard-link creation patterns, implementing mandatory access controls around extraction directories, and conducting regular security audits of archive processing workflows. The fix implemented in the referenced commit ensures that all link targets undergo the same normalization and validation procedures as regular filenames, maintaining consistent security boundaries throughout the extraction process.