Description
Directory traversal vulnerability in cpio 2.6 and earlier allows remote attackers to write to arbitrary directories via a .. (dot dot) in a cpio file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 1
- DSA-846-1 cpio - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- MDKSA-2007:233 vendor-advisory
- 27857 third-party-advisory
- 17123 third-party-advisory
- 17939 vdb-entry
- 16998 third-party-advisory
- DSA-846 vendor-advisory
- USN-189-1 vendor-advisory
- 13291 vdb-entry
- 20050420 cpio directory traversal vulnerability mailing-list
- SUSE-SR:2006:010 vendor-advisory
- 20117 third-party-advisory
- cpio-directory-traversal(20204) vdb-entry
- 18395 third-party-advisory
- 18290 third-party-advisory