CVE-2026-66484

Name of the Vulnerable Software and Affected Versions GNU cpio (affected versions not specified)

Description Path Traversal exists in the tar archive extraction functionality. When extracting a tar archive in copy-in mode using the --no-absolute-filenames option, the extracted file name is normalized, but the tar hard-link target is passed to the link to name() function without equivalent sanitization before the link() function is called. An attacker can provide a tar archive containing a hard-link entry with a linkname set to an absolute path outside the extraction directory. This allows the creation of a hard link to an existing file outside the intended directory, bypassing the protections of the --no-absolute-filenames option and enabling archive-controlled linkage to external files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.