Skip to main content

GNU cpio CVE-2026-66486

| EUVDEUVD-2026-55244 MEDIUM
Improper Encoding or Escaping of Output (CWE-116)
2026-08-10 CERT-PL GHSA-p5w5-qcg3-g8gx
Code Injection Cpio
4.6
CVSS 4.0 · Vendor: CERT-PL
Share

Severity by source

Vendor (CERT-PL) PRIMARY
4.6 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.3 LOW

Local vector because victim must execute cpio against a delivered archive; UI:R for required active user action; PR:N as no privileges needed to craft or supply the archive; I:L for display-level output spoofing only, with no confidentiality or availability impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
3.3 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Red Hat
6.1 MEDIUM
qualitative

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

1
Analysis Generated
Aug 10, 2026 - 11:08 vuln.today

DescriptionCVE.org

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.

This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30

AnalysisAI

Terminal escape sequence injection and output spoofing in GNU cpio's archive-listing mode (cpio -it) allows an attacker who supplies a crafted archive to manipulate terminal display or forge listing entries on the victim's screen. All versions of GNU cpio are affected per CPE data (cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:*), reported by CERT-PL. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the victim actively invoke `cpio -it` (or equivalent listing mode) on an attacker-controlled cpio archive within a terminal session. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 4.6 (Medium) accurately captures the constrained real-world risk: local attack vector (AV:L) combined with mandatory active user interaction (UI:A) sharply limits opportunistic exploitation, and the only confirmed impact is low integrity (VI:L) via display deception - there is no confidentiality or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation The primary fix is to apply upstream commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30 from the GNU cpio Savannah repository (https://git.savannah.gnu.org/cgit/cpio.git); a tagged packaged release containing this fix has not been independently confirmed at time of analysis, so users should monitor their distribution's package feed for an updated cpio package. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Cpio

View all
CVE-2021-38185 HIGH POC
7.8 Aug 08

GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_f
CVE-2016-2037 MEDIUM
6.5 Feb 22

The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-
CVE-2014-9112 MEDIUM POC
5.0 Dec 02

Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of
CVE-2015-1197 LOW POC
1.9 Feb 19

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink a
CVE-2026-66484 MEDIUM
4.6 Aug 10

Hard-link path traversal in GNU cpio's tar extraction mode enables an attacker-controlled archive to create hard links p
CVE-2026-66485 MEDIUM
4.6 Aug 10

Stack overflow in GNU cpio's make_path function (src/makepath.c) causes a denial of service when a victim extracts a cra

Same weakness CWE-116 – Improper Encoding or Escaping of Output

View all
CVE-2013-4547 HIGH POC
7.5
CVE-2026-20245 HIGH POC
7.8
CVE-2022-36446 CRITICAL POC
9.8
CVE-2017-8303 CRITICAL POC
9.8
CVE-2022-30781 HIGH POC
7.5
CVE-2023-46301 CRITICAL POC
9.8
CVE-2023-46300 CRITICAL POC
9.8
CVE-2022-41443 CRITICAL POC
9.8

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

Share

CVE-2026-66486 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy