GNU patch 2.8.1 released, fixing CVE-2026-115207
An oss-security note points to a GNU announcement, but the feed snippet gives no flaw details.
34
CVE-2026-115207
Arbitrary file creation in GNU patch reversal
- CVSS 3.1
- 5.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
GNU patch accepts absolute paths in patch headers during automatic reversal instead of rejecting them. A local attacker who persuades a user or automated workflow to apply a crafted patch can create files outside the working directory, with the permissions of the user running patch. Integrity is affected; confidentiality and availability are not.
What to do: Upgrade GNU patch to 2.8.1, which fixes CVE-2026-115207.
| Product | Affected | Fixed in |
|---|---|---|
| GNU patch | — | 2.8.1 |
Estimated exposure
largeCommon Unix tool; user must apply a patch — Standard utility on Unix-like systems; local vector and required user interaction limit reach.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.
- Weakness
- CWE-22
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N