Executive brief
GNU cpio is a file archiving utility used by administrators and systems to extract and manage archive files. A vulnerability in its tar archive extraction allows an attacker to create hard links to files outside the intended extraction directory, even when the --no-absolute-filenames safety option is enabled. This could allow an attacker to overwrite or manipulate arbitrary files on a system when a user extracts a malicious archive.
Technical details
This is a path traversal vulnerability (CWE-22) in GNU cpio's tar archive extraction functionality. When extracting with the --no-absolute-filenames option enabled, the extracted file name is properly normalized, but the hard-link target (linkname field in tar entries) bypasses this sanitization before being passed to the link function. An attacker can craft a tar archive containing a hard-link entry with an absolute path outside the extraction directory to cause cpio to create hard links to external files, circumventing the safety guarantee. The vulnerability affects cpio versions through 2.15 and has been fixed in subsequent commits including e2b9cbdd3354d2b1569b7390d1bc15c1930559ad.
Affected products
- GNU cpio through 2.15
Timeline
- 2026-08-10: disclosed
- 2026-08-28: patched: Fix committed (tar: keep symbolic link targets intact under --no-absolute-filenames)