Description
cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cpio | 2.11+dfsg-4.1 | — |
| Debian 13 | cpio | 2.11+dfsg-4.1 | — |
| Debian 12 | cpio | 2.11+dfsg-4.1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | cpio | 2.11+dfsg-1ubuntu1.2 | USN-2906-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cpio | 2.13-3.3 | openSUSE-SU-2024:10697-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | cpio | 2.13-r0 | — |
| Alpine v3.23 | cpio | 2.13-r0 | — |
| Alpine v3.22 | cpio | 2.13-r0 | — |
| Alpine v3.21 | cpio | 2.13-r0 | — |
| Alpine v3.20 | cpio | 2.13-r0 | — |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | cpio | 2.13-r0 | — |
| Alpine v3.18 | cpio | 2.13-r0 | — |
| Alpine v3.17 | cpio | 2.13-r0 | — |
| Alpine v3.16 | cpio | 2.13-r0 | — |
| Alpine v3.15 | cpio | 2.13-r0 | — |
| Alpine v3.14 | cpio | 2.13-r0 | — |
| Alpine v3.13 | cpio | 2.13-r0 | — |
| Alpine v3.12 | cpio | 2.13-r0 | — |
| Alpine v3.11 | cpio | 2.13-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | cpio | 2.13-13.amzn2023.0.3 | ALAS2023-2024-557 |
| Amazon Linux 2 | cpio | 2.12-11.amzn2.0.1 | ALAS2-2024-2489 |
Advisories 5
- USN-2906-1 cpio vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2024:10697-1 cpio-2.13-3.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-0542 cpio: Schwachstelle ermöglicht Manipulation von Dateien BSI CERT-Bund (WID) · Mar 18, 2024
- ALAS2023-2024-557 Important: cpio security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 5, 2024
- ALAS2-2024-2489 Important: cpio security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Mar 4, 2024
References
- 71914 vdb-entry
- MDVSA-2015:066 vendor-advisory
- [oss-security] 20150118 Re: CVE Request: cpio -- directory traversal mailing-list
- USN-2906-1 vendor-advisory
- http://advisories.mageia.org/MGASA-2015-0080.html
- [oss-security] 20150108 Directory traversals in cpio and friends? mailing-list
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774669
- [Bug-cpio] 20150108 cpio: directory traversal vulnerability via symlinks mailing-list
- http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html
- [oss-security] 20231221 Security vulnerability in Debian's cpio 2.13 mailing-list
- [oss-security] 20231227 xarchiver: Path traversal with crafted cpio archives mailing-list