Skip to main content

GNU cpio EUVDEUVD-2026-55244

| CVE-2026-66486 MEDIUM
Improper Encoding or Escaping of Output (CWE-116)
2026-08-10 CERT-PL GHSA-p5w5-qcg3-g8gx
Code Injection Cpio Gnu
4.6
CVSS 4.0 · Vendor: CERT-PL
Share

Severity by source

Vendor (CERT-PL) PRIMARY
4.6 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.3 LOW

Local vector because victim must execute cpio against a delivered archive; UI:R for required active user action; PR:N as no privileges needed to craft or supply the archive; I:L for display-level output spoofing only, with no confidentiality or availability impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
3.3 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Red Hat
6.1 MEDIUM
qualitative

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

1
Analysis Generated
Aug 10, 2026 - 11:08 vuln.today

DescriptionCVE.org

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.

This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30

AnalysisAI

Terminal escape sequence injection and output spoofing in GNU cpio's archive-listing mode (cpio -it) allows an attacker who supplies a crafted archive to manipulate terminal display or forge listing entries on the victim's screen. All versions of GNU cpio are affected per CPE data (cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:*), reported by CERT-PL. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog; however, exploitation requires only basic knowledge of cpio archive format and ANSI escape sequences once a victim can be induced to inspect a crafted archive.

Technical ContextAI

GNU cpio is a widely shipped Unix archive utility present in most Linux distributions. The vulnerability maps to CWE-116 (Improper Encoding or Escaping of Output): when the -it listing mode enumerates archive members, it writes filenames directly to stdout without sanitizing embedded control characters - specifically ASCII newline (\n) and ANSI/VT100 escape sequences (\x1b[...). Terminal emulators such as xterm, gnome-terminal, and konsole interpret these sequences natively, allowing injected bytes to reposition the cursor, overwrite previously displayed text, or forge additional listing lines. A newline injection can insert entirely fabricated filename entries into the listing, while ANSI sequences can alter color, cursor position, or even trigger terminal-level commands. The upstream fix is commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30 in the GNU cpio Savannah repository. The CPE string cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:* imposes no version bounds, indicating all shipped releases are affected.

RemediationAI

The primary fix is to apply upstream commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30 from the GNU cpio Savannah repository (https://git.savannah.gnu.org/cgit/cpio.git); a tagged packaged release containing this fix has not been independently confirmed at time of analysis, so users should monitor their distribution's package feed for an updated cpio package. As a compensating control where patching is not immediately possible, pipe cpio -it output through cat -v or strings to strip non-printable and control characters before display - note this alters output formatting and may affect scripts that parse the listing. A second workaround is to restrict cpio -it use to archives sourced exclusively from trusted, integrity-verified origins (e.g., GPG-signed packages), reducing the attacker's ability to deliver a crafted archive. Avoid processing untrusted cpio archives in interactive terminal sessions with ANSI-capable emulators until patched. The CERT-PL advisory (https://cert.pl/en/posts/2026/08/CVE-2026-66484) should be consulted for any additional vendor guidance.

More in Cpio

View all
CVE-2021-38185 HIGH POC
7.8 Aug 08

GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_f
CVE-2016-2037 MEDIUM
6.5 Feb 22

The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-
CVE-2014-9112 MEDIUM POC
5.0 Dec 02

Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of
CVE-2015-1197 LOW POC
1.9 Feb 19

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink a
CVE-2026-66484 MEDIUM
4.6 Aug 10

Hard-link path traversal in GNU cpio's tar extraction mode enables an attacker-controlled archive to create hard links p
CVE-2026-66485 MEDIUM
4.6 Aug 10

Stack overflow in GNU cpio's make_path function (src/makepath.c) causes a denial of service when a victim extracts a cra

Same weakness CWE-116 – Improper Encoding or Escaping of Output

View all
CVE-2013-4547 HIGH POC
7.5
CVE-2026-20245 HIGH POC
7.8
CVE-2022-36446 CRITICAL POC
9.8
CVE-2017-8303 CRITICAL POC
9.8
CVE-2022-30781 HIGH POC
7.5
CVE-2023-46301 CRITICAL POC
9.8
CVE-2023-46300 CRITICAL POC
9.8
CVE-2022-41443 CRITICAL POC
9.8

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

Share

EUVD-2026-55244 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy