CVE-2026-66484 is a path traversal vulnerability (CWE-22) in GNU cpio's tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized to prevent absolute paths. However, the tar hard-link target (linkname) is not equivalently sanitized before being passed to the link_to_name function, which calls the link system function. An attacker can craft a tar archive containing a hard-link entry with an absolute path outside the extraction directory, causing cpio to create a hard link to an external file. This violates the security expectation of the --no-absolute-filenames option. The vulnerability has been addressed and fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad.

An attacker providing a malicious tar archive can cause GNU cpio to create hard links to files outside the intended extraction directory, potentially leading to unauthorized file manipulation or overwriting of files outside the extraction scope. This breaks the security guarantee of the --no-absolute-filenames option and could be leveraged to affect system integrity or confidentiality depending on the files linked.

A fix for this vulnerability has been implemented in the referenced commit (e2b9cbdd3354d2b1569b7390d1bc15c1930559ad). Users should update GNU cpio to a version that includes this fix. Patch status is not explicitly confirmed in the advisory, so users should verify the presence of this commit or an official vendor update. Until patched, avoid extracting untrusted tar archives with the --no-absolute-filenames option or apply manual sanitization of hard-link targets.