Skip to content
fr Sign in
4.6 Medium

CVE-2026-66486 GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality

Description

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed. This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30

Affected products and versions

Product Affected versions Fixed in
cpio 2.15 earliest → 2.15 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of cpio

The 3 CVEs of cpio →
CVE-2026-66485 GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c 4.6 Medium CVE-2026-66484 GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality 4.6 Medium
Track this CVE