Bug#306693: cpio: allows extracting insecure pathnames (leading slash = / and dotdot = ..)

[t takahashi]

tags: security

The docs suggest grave or critical for security bugs, but I'm not sure
whether that is appropriate.