CVE-2023-7216

A path traversal vulnerability was found in the CPIO utility. This issue could allow a remote unauthenticated attacker to trick a user into opening a specially crafted archive. During the extraction process, the archiver could follow symlinks outside of the intended directory, which allows files to be written in arbitrary directories through symlinks.

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

EPSS

0.90% chance of exploitation in the next 30 days, 57th percentile

Published

2024-02-05

Updated

2026-02-25

Proof-of-concept exploits (1)

• https://bugzilla.redhat.com/show_bug.cgi?id=2249901

References

• CVE Record
• NVD entry

Related

• CVE-2023-7215
• CVE-2023-7219
• CVE-2023-7214
• CVE-2023-7220
• CVE-2023-7213
• CVE-2023-7221