Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a regr…

Description

Affected products

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Advisories 11

• USN-6755-1 cpio vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
• SUSE-SU-2024:0305-1 Security update for cpio SUSE / openSUSE Security Updates · Feb 4, 2026
• SUSE-SU-2024:0305-3 Security update for cpio SUSE / openSUSE Security Updates · Feb 4, 2026
• openSUSE-SU-2024:13653-1 cpio-2.15-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
• SUSE-SU-2024:0305-2 Security update for cpio SUSE / openSUSE Security Updates · Feb 4, 2026
• SUSE-SU-2024:0824-1 Security update for cpio SUSE / openSUSE Security Updates · Feb 4, 2026
• SUSE-SU-2024:0238-1 Security update for cpio SUSE / openSUSE Security Updates · Feb 4, 2026
• SUSE-SU-2024:0825-1 Security update for cpio SUSE / openSUSE Security Updates · Feb 4, 2026
• SUSE-SU-2024:0248-1 Security update for cpio SUSE / openSUSE Security Updates · Feb 4, 2026
• WID-SEC-2024-3377 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
• WID-SEC-2024-0245 cpio: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Jun 2, 2025

References

• https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=376d663340a9dc91c91a5849e5713f07571c1628 patch
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1059163 issue-tracking
• https://www.openwall.com/lists/oss-security/2023/12/21/8 mailing-list
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-7207 issue-tracking
• http://www.openwall.com/lists/oss-security/2024/01/05/1