Cpio
20 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Cpio, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Cpio CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 5 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 3 |
| 2026-09 | 0 |
Severity
How the 20 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- High4
- Medium11
- Low2
Latest CVEs
The 15 most recently published vulnerabilities affecting Cpio.
- CVE-2026-66486Improper Output Encoding in GNU cpio—
- CVE-2026-66485Uncontrolled Memory Allocation in GNU cpio—
- CVE-2026-66484Path Traversal in GNU cpio—
- BDU:2026-06236Уязвимость функции from_ascii() компонента copyin.c утилиты архивирования Cpio, позволяющая нарушителю вызвать отказ в обслуживании5.3
- BDU:2026-06260Уязвимость функции parser_parse_opt() утилиты архивирования Cpio, связанная с неправильным побитовым смещением целого числа, позволяющая нарушителю вызвать отказ в обслуживании5.5
- BDU:2026-06261Уязвимость утилиты архивирования Cpio, связанная с целочисленным переполнением, позволяющая нарушителю вызвать отказ в обслуживании6.2
- BDU:2026-06237Уязвимость функции parse_opt() утилиты архивирования Cpio, позволяющая нарушителю вызвать отказ в обслуживании5.5
- BDU:2026-06244Уязвимость функции read_name_from_file утилиты архивирования Cpio, позволяющая нарушителю вызвать отказ в обслуживании7.1
- CVE-2023-7216Cpio: extraction allows symlinks which enables remote command execution5.3
- CVE-2023-7207Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a regression in --no-absolute-filenames. Upstream has since prov...4.9
- CVE-2021-38185GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it i...7.8
- CVE-2019-14866In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting ...7.3
- CVE-2016-2037The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file.6.5
- CVE-2015-1197cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.1.9
- CVE-2014-9112Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive.5.0
Product grouping is registry-driven, with AI assist and human review. How it works