CVE-2026-66484: GNU cpio Path Traversal Vulnerability

CVE-2026-66484 Overview

CVE-2026-66484 is a path traversal vulnerability in GNU cpio that affects tar archive extraction in copy-in mode. The flaw resides in how cpio processes hard-link entries when the --no-absolute-filenames option is used. While the extracted file name is normalized, the hard-link target is passed to the link_to_name function without equivalent sanitization before calling link. An attacker can craft a tar archive containing a hard-link entry whose linkname points to an absolute path outside the extraction directory. Extraction then creates a hard link to an existing file outside the intended destination, breaking the safety guarantee provided by --no-absolute-filenames.

Critical Impact
A crafted tar archive can force GNU cpio to create hard links to arbitrary files outside the extraction directory, bypassing the --no-absolute-filenames protection and enabling archive-controlled linkage to sensitive system files.

Affected Products

GNU cpio (tar archive extraction in copy-in mode)
Utilities and scripts invoking cpio with the --no-absolute-filenames option
Linux distributions and build pipelines that rely on cpio for untrusted archive extraction

Discovery Timeline

2026-08-10 - CVE-2026-66484 published to the National Vulnerability Database (NVD)
2026-08-10 - Last updated in NVD
Fix committed upstream in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad

Technical Details for CVE-2026-66484

Vulnerability Analysis

GNU cpio supports extracting tar archives through its copy-in mode. The --no-absolute-filenames option is designed to constrain extraction inside the current working directory by rejecting or normalizing absolute paths. This defense is applied to the primary file name of each archive entry but is not applied consistently to hard-link targets. When cpio encounters a tar hard-link entry, it passes the archive-supplied linkname to link_to_name, which invokes the link system call without validating that the target resides within the extraction root. The result is a filesystem operation controlled entirely by the attacker-supplied archive metadata. This weakness is categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Root Cause

The root cause is inconsistent input sanitization. The extraction code path normalizes the destination file name but does not apply the same normalization to the linkname of a hard-link entry. Because link() follows the attacker-provided path as-is, --no-absolute-filenames no longer enforces its containment guarantee for hard-link entries.

Attack Vector

Exploitation requires a victim to extract an attacker-supplied tar archive using cpio in copy-in mode with --no-absolute-filenames. The archive contains a hard-link entry whose linkname is an absolute path such as /etc/shadow or another sensitive file. When the victim runs extraction, cpio creates a hard link inside the extraction directory that points to the external target. The attacker can then read the linked file through the extracted entry or interfere with the target file if permissions permit. Exploitation is local and requires user interaction to trigger extraction, which limits scale but is realistic in build systems, package tooling, and forensic workflows that process untrusted archives. See the CERT.pl analysis of CVE-2026-66484 for a full technical breakdown.

No verified public exploit code is available. The vulnerability mechanism is documented in prose because no sanitized proof-of-concept has been released.

Detection Methods for CVE-2026-66484

Indicators of Compromise

Unexpected hard links in extraction directories that reference absolute paths outside the archive root, such as files in /etc, /root, or /var.
Tar archives containing hard-link headers whose linkname field begins with / when inspected with tar -tvf or bsdtar.
cpio process invocations reading archives from untrusted sources followed by access to sensitive system files under a non-privileged user context.

Detection Strategies

Inspect tar archives before extraction using tar -tvf archive.tar and flag any hard-link entries whose target path is absolute or contains ...
Audit shell scripts and build pipelines that call cpio -i with --no-absolute-filenames on externally sourced archives.
Correlate cpio execution events with subsequent link or linkat syscalls resolving outside the current working directory using auditd or eBPF-based telemetry.

Monitoring Recommendations

Enable Linux audit rules on link and linkat syscalls originating from cpio and alert on targets outside expected extraction roots.
Log all archive extraction commands in CI/CD environments and centralize them for review.
Track the installed cpio version across the fleet and alert on hosts running versions predating commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad.

How to Mitigate CVE-2026-66484

Immediate Actions Required

Update GNU cpio to a build that includes commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad on all systems that process untrusted archives.
Treat externally supplied tar archives as untrusted input and extract them inside sandboxed directories, containers, or unprivileged users with no access to sensitive files.
Review automation that extracts archives with cpio -i --no-absolute-filenames and add explicit pre-extraction validation of hard-link targets.

Patch Information

The issue is fixed upstream in the GNU cpio Git repository in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad. Distribution maintainers are expected to backport the fix into stable package releases. Consult vendor advisories from your Linux distribution and pull updated cpio packages once available. Source references are available at the GNU cpio Git repository.

Workarounds

Avoid using cpio copy-in mode on tar archives from untrusted sources until patched packages are installed.
Pre-scan archives and reject any entry whose hard-link target is an absolute path or resolves outside the extraction directory.
Perform extraction inside an isolated chroot, container, or mount namespace so hard links to external files cannot reach sensitive data.

bash

# Pre-extraction check: reject archives with absolute hard-link targets
tar -tvf untrusted.tar | awk '/ link to \// {print "unsafe hardlink:", $0; found=1} END {exit found}'