Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux cpio allows path traversal with absolute symlinks
published 2 months ago
Summary
The cpio program in AlmaLinux can be tricked into accessing files outside the intended directory when it follows absolute symbolic links. This could let an attacker read or modify sensitive files on the system. Update cpio to the latest version that includes the upstream fix to stop this behavior.
What to do
- Update almalinux cpio to version 2.13-16.el9_2.tuxcare.els1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:AlmaLinux:9.2 | almalinux | cpio |
< 2.13-16.el9_2.tuxcare.els1 Fix: upgrade to 2.13-16.el9_2.tuxcare.els1
|
Original advisory text
cpio: Fix of CVE-2023-7207
- CVE-2023-7207: path traversal via absolute symlink targets under
--no-absolute-filenames; drop cpio-2.13-revert-CVE-2015-1197-fix.patch and
apply the upstream symlink-placeholder fix instead
--no-absolute-filenames; drop cpio-2.13-revert-CVE-2015-1197-fix.patch and
apply the upstream symlink-placeholder fix instead
References
- https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1786620962.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-7207 Vendor Advisory
Timeline
Published13 Aug 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1786620962 · OSV
Track software like this
Free during beta