GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files. This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad

ubuntu_linux USN-8704-1: Ubuntu 14.04 LTS / Ubuntu 16.04 LTS / Ubuntu 18.04 LTS / Ubuntu 20.04 LTS / Ubuntu 22.04 LTS / Ubuntu 24.04 LTS / Ubuntu 26.04 LTS / Ubuntu Pro Realtime 22.04 LTS / Ubuntu Pro Realtime 24.04 LTS : GNU cpio vulnerabilities (USN-8704-1)

According to the versions of the cpio packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c.
    The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an     archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long     nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio     process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial     of service.

    This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9(CVE-2026-66485)

    GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing     functionality. When listing archive members via cpio -it, member names are printed directly to output     without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded     newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence     injection when the listing is displayed.




    This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30(CVE-2026-66486)

    GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When     extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name     is normalized but the tar hard-link target is passed to the link_to_name function without equivalent     sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link     entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create     a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee     of --no-absolute-filenames and allowing archive-controlled linkage to external files.

    This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad(CVE-2026-66484)

Tenable has extracted the preceding description block directly from the EulerOS cpio security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the cpio packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing     functionality. When listing archive members via cpio -it, member names are printed directly to output     without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded     newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence     injection when the listing is displayed.




    This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30(CVE-2026-66486)

    GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When     extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name     is normalized but the tar hard-link target is passed to the link_to_name function without equivalent     sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link     entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create     a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee     of --no-absolute-filenames and allowing archive-controlled linkage to external files.

    This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad(CVE-2026-66484)

    GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c.
    The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an     archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long     nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio     process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial     of service.

    This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9(CVE-2026-66485)

Tenable has extracted the preceding description block directly from the EulerOS cpio security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4012-1 advisory.

    - CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the     creation of hard       links outside intended directory via malicious tar archives (bsc#1274856).
    - CVE-2026-66485: improper memory management in the `make_path` function when allocating memory allows for     denial of       service via crafted archives (bsc#1274857).
    - CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality     allows for       terminal control sequence injection via crafted archive member names (bsc#1274858).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21747-1 advisory.

    - CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the     creation of hard       links outside intended directory via malicious tar archives (bsc#1274856).
    - CVE-2026-66485: improper memory management in the `make_path` function when allocating memory allows for     denial of       service via crafted archives (bsc#1274857).
    - CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality     allows for       terminal control sequence injection via crafted archive member names (bsc#1274858).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0856 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-66486:
    GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing     functionality. When listing archive members via cpio -it, member names are printed directly to output     without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded     newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence     injection when the listing is displayed.

    CVE-2026-66485:
    GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c.
    The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an     archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long     nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio     process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial     of service.

    CVE-2026-66484:
    GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When     extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name     is normalized but the tar hard-link target is passed to the link_to_name function without equivalent     sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link     entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create     a hard link to an existing file outside the intended extraction directory.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When     extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name     is normalized but the tar hard-link target is passed to the link_to_name function without equivalent     sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link     entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create     a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee     of --no-absolute-filenames and allowing archive-controlled linkage to external files. This issue has been     fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad (CVE-2026-66484)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
364878	EulerOS 2.0 SP13 : cpio (EulerOS-SA-2026-4037)	Nessus	Huawei Local Security Checks	Local	medium
364807	EulerOS 2.0 SP13 : cpio (EulerOS-SA-2026-4128)	Nessus	Huawei Local Security Checks	Local	medium
364783	EulerOS 2.0 SP11 : cpio (EulerOS-SA-2026-4310)	Nessus	Huawei Local Security Checks	Local	medium
364751	EulerOS 2.0 SP11 : cpio (EulerOS-SA-2026-4219)	Nessus	Huawei Local Security Checks	Local	medium
348426	SUSE SLED15 / SLES15 Security Update : cpio (SUSE-SU-2026:4012-1)	Nessus	SuSE Local Security Checks	Local	medium
343942	openSUSE 16 Security Update : cpio (openSUSE-SU-2026:21747-1)	Nessus	SuSE Local Security Checks	Local	medium
339171	TencentOS Server 4: cpio (TSSA-2026:0856)	Nessus	Tencent Local Security Checks	Local	medium
334436	Linux Distros Unpatched Vulnerability : CVE-2026-66484	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-66484

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium

medium

medium

medium