Medium severity · published Aug 10, 2026
CVE-2026-66486
Improper Output Encoding in GNU cpio
4.6
CVSS
0.2%
EPSS
No
On KEV
Description
GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.
This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
cpio · GNU
through 2.15 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-66486
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-66486
cert.pl
https://cert.pl/en/posts/2026/08/CVE-2026-66484
git.savannah.gnu.org
https://git.savannah.gnu.org/cgit/cpio.git
More from cpio
7.8
CVE-2021-38185
GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap…
7.3
CVE-2019-14866
In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives
7.2
CVE-2010-4226
cpio, as used in build 2007.05.10, 2010.07.28, and possibly other versions, allows remote attackers to overwrite arbitrary files via a symlink within an RPM package archive
6.5
CVE-2016-2037
The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file
5.3
CVE-2023-7216
A path traversal vulnerability was found in the CPIO utility