Description
GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.
This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GNU | cpio | ≤ 2.15 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cpio | No fix yet | — |
| Debian 13 | cpio | No fix yet | — |
| Debian 12 | cpio | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | cpio | 2.15+dfsg-2.1ubuntu0.1 | USN-8704-1 |
| Ubuntu 24.04 LTS | cpio | 2.15+dfsg-1ubuntu2.1 | USN-8704-1 |
| Ubuntu 22.04 LTS | cpio | 2.13+dfsg-7ubuntu0.2 | USN-8704-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | cpio | 2.13+dfsg-2ubuntu0.4+esm1 | USN-8704-1 |
| Ubuntu Pro 18.04 LTS | cpio | 2.12+dfsg-6ubuntu0.18.04.4+esm1 | USN-8704-1 |
| Ubuntu Pro 16.04 LTS | cpio | 2.11+dfsg-5ubuntu1.1+esm2 | USN-8704-1 |
| Ubuntu Pro 14.04 LTS | cpio | 2.11+dfsg-1ubuntu1.2+esm3 | USN-8704-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | cpio | 2.13-150400.3.10.1 | SUSE-SU-2026:4012-1 |
| SLES 12 SP5 | cpio | 2.11-36.25.1 | SUSE-SU-2026:3959-1 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | cpio | 2.15-160000.3.1 | SUSE-SU-2026:23612-1 |
| SLES 16.0 | cpio | 2.15-160000.3.1 | SUSE-SU-2026:23612-1 |
| SLE Micro 6.2 | cpio | 2.15-160000.3.1 | SUSE-SU-2026:23464-1 |
| SLE Micro 6.1 | cpio | 2.15-slfo.1.1_3.1 | SUSE-SU-2026:23355-1 |
| SLE Micro 6.0 | cpio | 2.15-2.1 | SUSE-SU-2026:23441-1 |
| SLE Micro 5.5 | cpio | 2.13-150400.3.10.1 | SUSE-SU-2026:4012-1 |
| SLE Micro 5.4 | cpio | 2.13-150400.3.10.1 | SUSE-SU-2026:4012-1 |
| SLE Micro 5.3 | cpio | 2.13-150400.3.10.1 | SUSE-SU-2026:4012-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cpio | 2.15-8.1 | openSUSE-SU-2026:11618-1 |
| openSUSE Leap 16.0 | cpio | 2.15-160000.3.1 | openSUSE-SU-2026:21747-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cpio | 2.14-2 | — |
Advisories 10
- WID-SEC-2026-2722 cpio: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 13, 2026
- SUSE-SU-2026:23612-1 Security update for cpio SUSE / openSUSE Security Updates · Sep 29, 2026
- SUSE-SU-2026:23464-1 Security update for cpio SUSE / openSUSE Security Updates · Sep 14, 2026
- SUSE-SU-2026:23441-1 Security update for cpio SUSE / openSUSE Security Updates · Sep 14, 2026
- SUSE-SU-2026:4012-1 Security update for cpio SUSE / openSUSE Security Updates · Sep 13, 2026
- SUSE-SU-2026:3959-1 Security update for cpio SUSE / openSUSE Security Updates · Sep 13, 2026
- SUSE-SU-2026:23355-1 Security update for cpio SUSE / openSUSE Security Updates · Sep 10, 2026
- openSUSE-SU-2026:21747-1 Security update for cpio SUSE / openSUSE Security Updates · Sep 9, 2026
- USN-8704-1 cpio vulnerabilities Ubuntu Security Notices (USN) · Sep 1, 2026
- openSUSE-SU-2026:11618-1 cpio-2.15-8.1 on GA media SUSE / openSUSE Security Updates · Aug 28, 2026
References
- https://cert.pl/en/posts/2026/08/CVE-2026-66484 third-party-advisory
- https://git.savannah.gnu.org/cgit/cpio.git product