CVE-2023-7216

A path traversal vulnerability was found in the CPIO utility. This issue could allow a remote unauthenticated attacker to trick a user into opening a specially crafted archive. During the extraction process, the archiver could follow symlinks outside of the intended directory, which allows files to be written in arbitrary directories through symlinks.

Score

CVSS 3.1 5.3 Medium

Status

Modified - secalert@redhat.com

Published

2024-02-05

Last modified

2026-02-25

Weaknesses

CWE-22, CWE-59

Affected products

• Cpio (Gnu)
• Enterprise Linux (Redhat)

References

• https://access.redhat.com/security/cve/CVE-2023-7216
• https://bugzilla.redhat.com/show_bug.cgi?id=2249901