CVE-2026-66486

EUVD-2026-55244

10.08.2026, 11:17

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.




This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
CERT-PL	CNA	4.6 MEDIUM	LOCAL	LOW	NONE	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 7.09%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
gnu	cpio	𝑥 ≤ 2.15	CNA

Debian Releases

Debian Product

Codename

cpio

bookworm	postponed
bullseye	postponed
forky	vulnerable
sid	vulnerable
trixie	no-dsa

Ubuntu Releases

Ubuntu Product

Codename

cpio

bionic	Fixed 2.12+dfsg-6ubuntu0.18.04.4+esm1 released
focal	Fixed 2.13+dfsg-2ubuntu0.4+esm1 released
jammy	Fixed 2.13+dfsg-7ubuntu0.2 released
noble	Fixed 2.15+dfsg-1ubuntu2.1 released
resolute	Fixed 2.15+dfsg-2.1ubuntu0.1 released
trusty	Fixed 2.11+dfsg-1ubuntu1.2+esm3 released
xenial	Fixed 2.11+dfsg-5ubuntu1.1+esm2 released

openSUSE / SLES Releases

openSUSE Product

Release

cpio

suse enterprise desktop 15 SP7	2.13-150400.3.10.1 fixed
suse enterprise sap 15 SP7	2.13-150400.3.10.1 fixed
suse enterprise server 15 SP4	2.13-150400.3.10.1 fixed
suse enterprise server 15 SP7	2.13-150400.3.10.1 fixed

cpio-lang

suse enterprise desktop 15 SP7	2.13-150400.3.10.1 fixed
suse enterprise sap 15 SP7	2.13-150400.3.10.1 fixed
suse enterprise server 15 SP4	2.13-150400.3.10.1 fixed
suse enterprise server 15 SP7	2.13-150400.3.10.1 fixed

cpio-mt

suse enterprise desktop 15 SP7	2.13-150400.3.10.1 fixed
suse enterprise sap 15 SP7	2.13-150400.3.10.1 fixed
suse enterprise server 15 SP4	2.13-150400.3.10.1 fixed
suse enterprise server 15 SP7	2.13-150400.3.10.1 fixed

Azure Linux Releases

Azure Package

Release

cpio

Azure Linux 3.0

0:2.14-2.azl3

fixed

Common Weakness Enumeration

CWE-116 - Improper Encoding or Escaping of Output
The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

References

https://cert.pl/en/posts/2026/08/CVE-2026-66484

https://git.savannah.gnu.org/cgit/cpio.git