OESA-2026-3540

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-3540
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2026-3540.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2026-3540
Upstream
  • CVE-2026-66486
Published
2026-08-30T04:15:34Z
Modified
2026-08-30T04:31:11Z
Severity
  • 4.6 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
cpio security update
Details

GNU cpio copies files into or out of a cpio or tar archive. The archive can be another file on the disk, a magnetic tape, or a pipe.

Security Fix(es):

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.

This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30(CVE-2026-66486)

Database specific 
{
    "severity": "Medium"
}
References

Affected packages

openEuler:20.03-LTS-SP4
cpio

Package

Name
cpio
Purl
pkg:rpm/openEuler/cpio&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.13-10.oe2003sp4

Ecosystem specific 

{
    "aarch64": [
        "cpio-2.13-10.oe2003sp4.aarch64.rpm",
        "cpio-debuginfo-2.13-10.oe2003sp4.aarch64.rpm",
        "cpio-debugsource-2.13-10.oe2003sp4.aarch64.rpm"
    ],
    "noarch": [
        "cpio-help-2.13-10.oe2003sp4.noarch.rpm"
    ],
    "src": [
        "cpio-2.13-10.oe2003sp4.src.rpm"
    ],
    "x86_64": [
        "cpio-2.13-10.oe2003sp4.x86_64.rpm",
        "cpio-debuginfo-2.13-10.oe2003sp4.x86_64.rpm",
        "cpio-debugsource-2.13-10.oe2003sp4.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3540.json"
openEuler:22.03-LTS-SP4
cpio

Package

Name
cpio
Purl
pkg:rpm/openEuler/cpio&distro=openEuler-22.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.13-13.oe2203sp4

Ecosystem specific 

{
    "aarch64": [
        "cpio-2.13-13.oe2203sp4.aarch64.rpm",
        "cpio-debuginfo-2.13-13.oe2203sp4.aarch64.rpm",
        "cpio-debugsource-2.13-13.oe2203sp4.aarch64.rpm"
    ],
    "noarch": [
        "cpio-help-2.13-13.oe2203sp4.noarch.rpm"
    ],
    "src": [
        "cpio-2.13-13.oe2203sp4.src.rpm"
    ],
    "x86_64": [
        "cpio-2.13-13.oe2203sp4.x86_64.rpm",
        "cpio-debuginfo-2.13-13.oe2203sp4.x86_64.rpm",
        "cpio-debugsource-2.13-13.oe2203sp4.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3540.json"
openEuler:24.03-LTS-SP1
cpio

Package

Name
cpio
Purl
pkg:rpm/openEuler/cpio&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.14-6.oe2403sp1

Ecosystem specific 

{
    "aarch64": [
        "cpio-2.14-6.oe2403sp1.aarch64.rpm",
        "cpio-debuginfo-2.14-6.oe2403sp1.aarch64.rpm",
        "cpio-debugsource-2.14-6.oe2403sp1.aarch64.rpm"
    ],
    "noarch": [
        "cpio-help-2.14-6.oe2403sp1.noarch.rpm"
    ],
    "src": [
        "cpio-2.14-6.oe2403sp1.src.rpm"
    ],
    "x86_64": [
        "cpio-2.14-6.oe2403sp1.x86_64.rpm",
        "cpio-debuginfo-2.14-6.oe2403sp1.x86_64.rpm",
        "cpio-debugsource-2.14-6.oe2403sp1.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3540.json"
openEuler:24.03-LTS-SP3
cpio

Package

Name
cpio
Purl
pkg:rpm/openEuler/cpio&distro=openEuler-24.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.14-6.oe2403sp3

Ecosystem specific 

{
    "aarch64": [
        "cpio-2.14-6.oe2403sp3.aarch64.rpm",
        "cpio-debuginfo-2.14-6.oe2403sp3.aarch64.rpm",
        "cpio-debugsource-2.14-6.oe2403sp3.aarch64.rpm"
    ],
    "noarch": [
        "cpio-help-2.14-6.oe2403sp3.noarch.rpm"
    ],
    "src": [
        "cpio-2.14-6.oe2403sp3.src.rpm"
    ],
    "x86_64": [
        "cpio-2.14-6.oe2403sp3.x86_64.rpm",
        "cpio-debuginfo-2.14-6.oe2403sp3.x86_64.rpm",
        "cpio-debugsource-2.14-6.oe2403sp3.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3540.json"
openEuler:24.03-LTS-SP4
cpio

Package

Name
cpio
Purl
pkg:rpm/openEuler/cpio&distro=openEuler-24.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.14-6.oe2403sp4

Ecosystem specific 

{
    "aarch64": [
        "cpio-2.14-6.oe2403sp4.aarch64.rpm",
        "cpio-debuginfo-2.14-6.oe2403sp4.aarch64.rpm",
        "cpio-debugsource-2.14-6.oe2403sp4.aarch64.rpm"
    ],
    "noarch": [
        "cpio-help-2.14-6.oe2403sp4.noarch.rpm"
    ],
    "src": [
        "cpio-2.14-6.oe2403sp4.src.rpm"
    ],
    "x86_64": [
        "cpio-2.14-6.oe2403sp4.x86_64.rpm",
        "cpio-debuginfo-2.14-6.oe2403sp4.x86_64.rpm",
        "cpio-debugsource-2.14-6.oe2403sp4.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3540.json"