CVE catalog

CVE-2026-66486

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output wi

[CVE catalog]

Severity
Medium · CVSS 6.1CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.18% · Oct 25, 2026

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed. This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancpiosid2.15+dfsg-2.1vulnerable
Debiancpioforky2.15+dfsg-2.1vulnerable
Debiancpiotrixie2.15+dfsg-2vulnerable
Debiancpiobookworm2.13+dfsg-7.1vulnerable
Ubuntucpionoble2.15+dfsg-1ubuntu2.1fixed
Ubuntucpiopro2.12+dfsg-9vulnerable
Ubuntucpiopro2.12+dfsg-9ubuntu1vulnerable
Ubuntucpiopro2.13+dfsg-1vulnerable
Ubuntucpiopro2.13+dfsg-2vulnerable
Ubuntucpiopro2.13+dfsg-2ubuntu0.3vulnerable
Ubuntucpiopro2.13+dfsg-2ubuntu0.4vulnerable
Ubuntucpiopro2.13+dfsg-2ubuntu0.4+esm1fixed
Ubuntucpio22.042.13+dfsg-4ubuntu4vulnerable
Ubuntucpio22.042.13+dfsg-7vulnerable
Ubuntucpio22.042.13+dfsg-7ubuntu0.1vulnerable
Ubuntucpio22.042.13+dfsg-7ubuntu0.2fixed
Ubuntucpio24.042.13+dfsg-7.1vulnerable
Ubuntucpio24.042.14+dfsg-1vulnerable
Ubuntucpio24.042.15+dfsg-1vulnerable
Ubuntucpio24.042.15+dfsg-1ubuntu1vulnerable
Ubuntucpio24.042.15+dfsg-1ubuntu2vulnerable
Ubuntucpio24.042.15+dfsg-1ubuntu2.1fixed
Ubuntucpio26.042.15+dfsg-2ubuntu1vulnerable
Ubuntucpio26.042.15+dfsg-2.1vulnerable
Ubuntucpio26.042.15+dfsg-2.1ubuntu0.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancpiosourcesid(unfixed)not yet assignedNot reported[1144387]
Debiancpiosourceforky(unfixed)not yet assignedNot reported[1144387]
Debiancpiosourcetrixie(unfixed)not yet assignedNot reported[1144387]
Debiancpiosourcebookworm(unfixed)not yet assignedNot reported[1144387]
Ubuntucpiodebnoble2.15+dfsg-1ubuntu2.1Not reportedNot reportedNot reported
Ubuntucpiodebpro2.13+dfsg-2ubuntu0.4+esm1Not reportedUBUNTU-CVE-2026-66486Not reported
Ubuntucpiodeb22.042.13+dfsg-7ubuntu0.2Not reportedUBUNTU-CVE-2026-66486Not reported
Ubuntucpiodeb24.042.15+dfsg-1ubuntu2.1Not reportedUBUNTU-CVE-2026-66486Not reported
Ubuntucpiodeb26.042.15+dfsg-2.1ubuntu0.1Not reportedUBUNTU-CVE-2026-66486Not reported

[Debian bug #1144387]

Notes

[trixie] cpio: Minor issue [bookworm] cpio: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [cpio]Affected
    Details (2)

    • 2.13+dfsg-7.1 · amd64 · bookworm

      Affected

      nvd · cpio · debian · bookworm; nvd · cpio · debian · 12

    • 2.13+dfsg-7.1 · arm64 · bookworm

      Affected

      nvd · cpio · debian · bookworm; nvd · cpio · debian · 12

  • [cpio-win32]Affected

    Source package: [cpio]

    Details (2)

    • 2.13+dfsg-7.1 · all · bookworm

      Affected

      nvd · cpio · debian · bookworm; nvd · cpio · debian · 12

    • 2.13+dfsg-7.1 · all · bookworm

      Affected

      nvd · cpio · debian · bookworm; nvd · cpio · debian · 12

[Debian 13 (Trixie)]

  • [cpio]Affected
    Details (2)

    • 2.15+dfsg-2 · amd64 · trixie

      Affected

      nvd · cpio · debian · 13

    • 2.15+dfsg-2 · arm64 · trixie

      Affected

      nvd · cpio · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]