GNU Cpio up to 2.15 Archive Member Listing injection

Summaryinfo

A vulnerability was found in GNU Cpio up to 2.15. It has been classified as critical. This impacts an unknown function of the component Archive Member Listing. This manipulation causes injection. This vulnerability is registered as CVE-2026-66486. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in GNU Cpio up to 2.15. It has been declared as critical. Affected by this vulnerability is an unknown code block of the component Archive Member Listing. The manipulation with an unknown input leads to a injection vulnerability. The CWE definition for the vulnerability is CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed. This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30

The advisory is shared at cert.pl. This vulnerability is known as CVE-2026-66486 since 07/27/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1055 for this issue.

Applying the patch 2ff9600c9ef32e88759843cdbde74c8db5ae9b30 is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-2722). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Open Source cpio

Productinfo

Vendor

• GNU

Name

• Cpio

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion