Hello, I found a path traversal vulnerability in GNU cpio (HEAD, 2.15.90) that bypasses --no-absolute-filenames, and I am reporting it here for coordinated disclosure before any public discussion.
## Summary
Extracting a crafted tar archive with 'cpio -id --no-absolute-filenames'
writes files OUTSIDE the extraction directory. Member names containing
interior '../' sequences (e.g. 'sub/../../evil') are not sanitized:
paxutils safer_name_suffix() only strips LEADING '/' and '../', so
interior sequences pass through intact. GNU tar rejects such names
('Member name contains ..'); cpio does not.
This is a partial regression of CAN-2005-1229 and an adjacent gap to
CVE-2026-66484 (whose fix only covered hard-link targets with leading
'/'/'../' — the same incomplete sanitizer is applied to member names).
## Reproduction
1. Create a tar with entries: [dir sub/] + [file sub/../../evil, 5 bytes]
2. mkdir /tmp/x && cd /tmp/x
3. cpio -id --no-absolute-filenames < archive.tar
4. Result: ../evil is created OUTSIDE /tmp/x
The chain (verified in code + PoC with the real functions):
- process_copy_in() (src/copyin.c:1490) sanitizes only via
cpio_safer_name_suffix(file_hdr.c_name, false, !no_abs_paths_flag, false)
- safer_name_suffix() returns 'sub/../../evil' intact (first component
'sub' is neither '/' nor '..')
- With -d, create_all_directories() -> make_path0('sub/../..') skips the
'..' components (they stat OK), then open('sub/../../evil') resolves
through the existing 'sub/' and creates '../evil' outside.
Requires tar format, -d (or pre-existing 'sub/'), and
--no-absolute-filenames — precisely the 'safe' flag, which is defeated.
## Fix
Attached patch modifies cpio_safer_name_suffix() in src/util.c: when
sanitization is active, it collapses interior 'xxx/../' sequences and
re-strips any newly exposed leading '../' ('sub/../../evil' -> 'evil',
'a/b/../c' -> 'a/c'). Symlink targets are intentionally left verbatim
(per b19a03e + tests/symlink-tar-abs.at).
Validated with 16 adversarial inputs (all contained) and 6000 fuzzed
tar headers (0 crashes, ASan+UBSan).
I am happy to coordinate on timing/embargo. Please let me know how you
would like to proceed.
Best regards,
Adrian Martinez <[email protected]>
cpio-path-traversal.patch
Description: Binary data
