CVE-2026-66484 is a path traversal vulnerability in GNU cpio affecting Red Hat Hardened Images. When extracting tar archives in copy-in mode using the --no-absolute-filenames option, the hard-link target name is not properly sanitized. An attacker can craft a malicious tar archive containing a hard-link entry with an absolute path, causing cpio to create hard links to files outside the extraction directory. This bypasses security controls and may allow unauthorized modification of files. The issue is fixed in cpio version 2.15-10.1.hum1 for aarch64 and x86_64 architectures.

The vulnerability allows an attacker to create or overwrite files outside the intended extraction directory by exploiting improper sanitization of hard-link targets during archive extraction. This can lead to unauthorized file modifications, potentially affecting system integrity. The impact is rated low by Red Hat, with no confidentiality or availability impact reported.

A security update is available that fixes this vulnerability in the cpio RPM packages version 2.15-10.1.hum1 for aarch64 and x86_64. Users should apply this update to remediate the issue. Additionally, avoid using the --no-absolute-filenames option when extracting untrusted tar archives with cpio to mitigate risk.