CVE-2023-7216

What it actually does

The path traversal flaw in cpio allows extraction of specially crafted archives to follow symbolic links, writing files to arbitrary directories outside the intended extraction root.

Why it matters to the business

Attackers can overwrite or place files in sensitive system locations, leading to integrity violations, potential privilege escalation, or persistence on affected systems that process untrusted archives with cpio.

How an attack unfolds

An attacker creates a malicious archive containing symbolic links pointing outside the target directory, then tricks a user or automated process into extracting it with cpio; during extraction the tool follows the links and writes attacker-controlled content to arbitrary locations. Public exploit code is available though real-world adoption remains low.

How to fix it

Replace vulnerable cpio installations with the latest patched releases from GNU or Red Hat; where updates are unavailable, avoid extracting untrusted archives and prefer alternative archive tools with stricter symlink handling.

How to confirm the fix worked

Confirm cpio version against vendor advisories, test extraction of a benign symlink-containing archive in an isolated directory, and verify that files remain confined to the target path.

Typical attack path

1. Craft archive with symlinks targeting sensitive paths
2. Deliver archive via email, download, or shared storage
3. Victim or script invokes cpio to extract the archive
4. Cpio follows symlinks and writes files outside intended directory
5. Attacker content persists or overwrites critical files

How to detect it

Review process execution logs for cpio invocations on unexpected archives, inspect file-creation timestamps around extraction events, and search system logs for writes outside normal extraction directories.

What your security team should do

• Block or sandbox cpio extraction of archives from untrusted sources
• Deploy updated cpio packages across all affected GNU and Red Hat systems
• Audit scripts and workflows that invoke cpio for untrusted input handling
• Monitor file-system changes during archive extraction for unexpected writes