CVE-2026-66486
Improper Output Encoding in GNU cpio
- State
- Published
- Severity
- 4.6 Medium
- Published
- Aug 10, 2026
- Updated
- Aug 10, 2026
- Reserved
- Jul 27, 2026
Description
GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.
This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.6 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | CERT-PL |
Weaknesses
- CWE-116 Improper Encoding or Escaping of Output
Affected Products
| Product | Versions |
|---|---|
cpioGNU |
|
References
- https://cert.pl/en/posts/2026/08/CVE-2026-66484third-party-advisory
- https://git.savannah.gnu.org/cgit/cpio.gitproduct
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.