PT-2026-69442
CVE-2026-66486
·
Published
2026-08-10
·
Updated
2026-09-07
Description by
CVSS 4.0
4.6
MediumMetricsAV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
GNU cpio (affected versions not specified)
Description
Improper encoding or escaping of output occurs in the archive member listing functionality. When listing archive members using the
cpio -it command, member names are printed directly to the output without quoting or escaping. This allows an attacker to create a cpio archive with member names containing embedded newline characters or ANSI escape sequences, leading to forged listing entries or terminal control sequence injection when the listing is displayed.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾