CVE-2026-66486

Name	CVE-2026-66486
Description	GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed. This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1144387

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
cpio (PTS)	bullseye	2.13+dfsg-7.1~deb11u1	vulnerable
	bookworm	2.13+dfsg-7.1	vulnerable
	trixie	2.15+dfsg-2	vulnerable
	forky, sid	2.15+dfsg-2.1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
cpio	source	(unstable)	(unfixed)			1144387

Notes

[trixie] - cpio <no-dsa> (Minor issue)
[bookworm] - cpio <postponed> (Minor issue)
[bullseye] - cpio <postponed> (Minor issue)
https://cert.pl/en/posts/2026/08/CVE-2026-66484
Fixed by: https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=2ff9600c9ef32e88759843cdbde74c8db5ae9b30