Live › vulnerability › CVE-2026-115207
Go to dashboardGNU patch accepts absolute file paths in patch headers during automatic reversal instead of rejecting them. A crafted patch file can make it create files in arbitrary locations with the permissions of the user running it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone who runs GNU patch on patch files they did not write, especially automated pipelines that apply externally supplied diffs or auto-reverse them. Systems that only apply patches they generate themselves have little exposure. The sources do not say which GNU patch versions are affected.
No product ranges from the sources yet.
patch --version to see the installed GNU patch version, then compare it against the fixed release in the NVD entry (unknown in the sources)patch on patch files from outside the teamEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.
This page as .md · .json · in your agent: get_signal("CVE-2026-115207")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.