GNU cpio patches three archive extraction flaws
CERT Polska coordinated disclosure of three GNU cpio vulnerabilities involving path traversal, stack overflow, and terminal escape injection during archive extraction.
Sourcecert.pl — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska disclosed three vulnerabilities in GNU cpio affecting tar archive extraction and listing functionality, reported by researchers from AFINE Team. CVE-2026-66484 is a path traversal flaw where hard-link targets bypass the --no-absolute-filenames sanitization, allowing a malicious archive to create hard links pointing outside the extraction directory. CVE-2026-66485 is an uncontrolled memory allocation in make_path using alloca on archive-controlled path lengths, enabling a crafted archive to trigger a stack overflow and crash the cpio process (denial of service). CVE-2026-66486 involves improper escaping of member names during cpio -it listing, allowing embedded newlines or ANSI escape sequences to forge listing entries or inject terminal control sequences.
All three issues require a victim to extract or list an attacker-supplied malicious archive; there is no indication of remote network exploitation or active exploitation in the wild. Fixes have been committed upstream for each vulnerability. This is a routine responsible-disclosure advisory affecting a widely-used but low-profile utility, with impact limited to local file-integrity bypass, DoS, and terminal injection scenarios rather than remote code execution.
Mentioned in this report
Detection guidance
cpio List Mode with Suspicious Output Redirection
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
cpio -it (list mode) output redirected to file or pipe, enabling capture of terminal-injection sequences from malicious archive member names (CVE-2026-66486). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: cpio List Mode with Suspicious Output Redirection
description: Detects cpio -it listing mode with output redirected to a file or pipe,
which can capture ANSI escape or newline-injection sequences embedded in archive
member names. Generalises on the -it flag and redirection operators rather than
specific payload strings.
tags:
- attack.t1204
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \cpio.exe
CommandLine|contains:
- ' > '
- ' >> '
- ' | '
filter_admin_logging:
ParentImage|endswith:
- \bash.exe
- \cmd.exe
CommandLine|contains:
- 2>&1
condition: selection and not filter_admin_logging
falsepositives:
- System administrators listing archive contents to logs for auditing
- Build scripts capturing cpio inventory for manifest generation
level: low
id: 3f82de5c-3ab8-53c3-9ecb-9674a0f9910b
status: experimental
author: Vorant
cpio Extraction with Hard-Link Traversal
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
cpio extracting an archive without --no-absolute-filenames flag, permitting hard-link targets to escape the extraction directory (CVE-2026-66484). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: cpio Extraction with Hard-Link Traversal
description: Detects cpio archive extraction (-i flag) executed WITHOUT the --no-absolute-filenames
mitigation, allowing malicious hard-link targets to traverse outside the intended
extraction directory. Matches the absence of the safety flag during extraction.
tags:
- attack.t1204
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \cpio.exe
CommandLine|contains: ' -F '
filter_safe_extraction:
CommandLine|contains: --no-absolute-filenames
filter_stdin_only:
CommandLine|contains: ' -i -d'
condition: selection and not (filter_safe_extraction or filter_stdin_only)
falsepositives:
- Extraction of known-safe archives from trusted sources without explicit safety flags
- Legacy scripts that predate the --no-absolute-filenames mitigation
level: medium
id: bb1c8629-d539-51f3-898b-c5cc3ccc6b89
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/08/CVE-2026-66484
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs