CVE-2023-7216CWE-59

Cpio: extraction allows symlinks which enables remote command execution

Medium · published February 5, 2024

CVSS v3.1
5.3
EPSS
1%
Percentile
59.2
In the wild
Unconfirmed
What it is

A path traversal vulnerability was found in the CPIO utility. This issue could allow a remote unauthenticated attacker to trick a user into opening a specially crafted archive. During the extraction process, the archiver could follow symlinks outside of the intended directory, which allows files to be written in arbitrary directories through symlinks.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00899 · 59.2th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2024-02-05T15:12Z
EPSS history
Timeline
  • 05 FEB 15:12Z
    Cpio: extraction allows symlinks which enables remote command execution
    cvelistv5