CVE-2026-66484 is a path traversal vulnerability in GNU cpio affecting the extraction of tar archives in copy-in mode with the --no-absolute-filenames option. The issue arises because the hard-link target name is not sanitized, allowing an attacker to craft a malicious tar archive that creates hard links pointing to files outside the intended extraction directory. This can bypass security controls and potentially lead to unauthorized file modifications. Red Hat has released an update for Red Hat Hardened Images RPMs (cpio-2.15-10.1.hum1) to address this vulnerability. The vulnerability is associated with CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Red Hat rates the severity as low and advises avoiding the risky extraction option for untrusted archives.

An attacker who provides a specially crafted tar archive can cause cpio to create hard links outside the intended extraction directory, potentially overwriting or creating critical files. This may lead to unauthorized modification of files, which could bypass security mechanisms or cause denial of service by corrupting important files. The integrity impact is low, confidentiality impact is none, and availability impact is none according to Red Hat's assessment.

Red Hat has issued a security update for the cpio package in Red Hat Hardened Images RPMs (version 2.15-10.1.hum1). Users should apply this update to remediate the vulnerability. Additionally, avoid using the --no-absolute-filenames option when extracting untrusted tar archives with cpio to prevent exploitation. No other mitigation actions are indicated by the vendor.