CVE-2023-7207: GNU Cpio

Medium severity, CVSS 4.9. EPSS: 0.9% chance of exploitation in the next 30 days.

Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a regression in --no-absolute-filenames. Upstream has since provided a proper fix to --no-absolute-filenames.

Affected products

• GNU Cpio: version 2.13 only

Published 2024-02-29. Last modified 2026-06-17.