CVE-2023-7216
Cpio: extraction allows symlinks which enables remote command execution
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Cpio: extraction allows symlinks which enables remote command execution
A path traversal vulnerability was found in the CPIO utility. This issue could allow a remote unauthenticated attacker to trick a user into opening a specially crafted archive. During the extraction process, the archiver could follow symlinks outside of the intended directory, which allows files to be written in arbitrary directories through symlinks.
Reserved 2024-01-05 | Published 2024-02-05 | Updated 2024-11-04 | Assigner redhatImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
| 2023-11-15: | Reported to Red Hat. |
| 2024-02-05: | Made public. |
Red Hat would like to thank Febin Mon Saji for reporting this issue.
access.redhat.com/security/cve/CVE-2023-7216
bugzilla.redhat.com/show_bug.cgi?id=2249901 (RHBZ#2249901)
Support options
