{"id":"CVE-2026-115207","kind":"vulnerability","aliases":["CVE-2026-115207"],"related":[],"title":"GNU patch: crafted patch file creates files outside the working directory","description":"A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.","summary":"GNU patch accepts absolute file paths in patch headers during automatic reversal instead of rejecting them. A crafted patch file can make it create files in arbitrary locations with the permissions of the user running it.","severity":"medium","cvss":5.5,"epss":0.0013,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci-pipelines","gnu-patch","linux","package"],"not_affected_if":["patch-files-trusted-only"],"how_to_check":"- `patch --version` to see the installed GNU patch version, then compare it against the fixed release in the NVD entry (unknown in the sources)\n- Check whether any build, CI or deploy job runs `patch` on patch files from outside the team","fix":"- Upgrade GNU patch to a release that includes the fix (the fixed version is unknown in the sources)\n- Until then, only apply patch files from trusted sources and run patch in a throwaway directory","status":"open","published_at":"2026-10-22T11:17:50+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:10:44+00:00","updated_at":"2026-10-25T04:10:44+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:10:44Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GNU patch to a release that includes the fix (the fixed version is unknown in the sources)\n- Until then, only apply patch files from trusted sources and run patch in a throwaway directory","reach":"local","title":"GNU patch: crafted patch file creates files outside the working directory","impact":"medium","summary":"GNU patch accepts absolute file paths in patch headers during automatic reversal instead of rejecting them. A crafted patch file can make it create files in arbitrary locations with the permissions of the user running it.","category":"package","nicknames":[],"who_cares":["gnu-patch","linux","ci-pipelines"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker writes arbitrary files as the running user, possibly overwriting scripts.","analyst_note":"Check the NVD entry and the GNU patch release notes for the affected and fixed versions; the sources here do not name them.","how_to_check":"- `patch --version` to see the installed GNU patch version, then compare it against the fixed release in the NVD entry (unknown in the sources)\n- Check whether any build, CI or deploy job runs `patch` on patch files from outside the team","needs_analyst":true,"not_affected_if":["patch-files-trusted-only"],"who_is_affected":"Anyone who runs GNU patch on patch files they did not write, especially automated pipelines that apply externally supplied diffs or auto-reverse them. Systems that only apply patches they generate themselves have little exposure. The sources do not say which GNU patch versions are affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000622,"input_tokens":3363,"output_tokens":571,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115207':14A,17A '-2026':13A,16A 'absolut':29B,102C 'accept':28B,109C 'achiev':71C 'appli':88C 'arbitrari':52B,72C,120C 'attack':69C 'autom':85C 'automat':36B,99C 'ci':19B 'ci-pipelin':18B 'consequ':113C 'craft':3A,43B,91C 'creat':6A,49B,117C 'creation':74C 'cve':12A,15A 'directori':11A,79C 'due':94C 'entic':81C 'execut':127C 'file':5A,7A,30B,45B,50B,73C,93C,103C,118C 'flaw':62C 'found':64C 'gnu':1A,22B,26B,66C 'gnu-patch':21B 'header':34B,107C 'instead':38B 'intend':77C 'linux':24B 'locat':53B,121C 'make':47B 'miss':96C 'outsid':8A,75C 'packag':25B 'patch':2A,4A,23B,27B,33B,44B,67C,92C,100C,106C 'path':31B,104C 'permiss':56B,124C 'pipelin':20B 'rather':110C 'reject':40B,112C 'revers':37B,101C 'run':60B 'special':90C 'user':59B,83C,128C 'util':115C 'valid':97C 'work':10A,78C 'workflow':86C","nicknames":[],"mitigations":[],"who_affected":"Anyone who runs GNU patch on patch files they did not write, especially automated pipelines that apply externally supplied diffs or auto-reverse them. Systems that only apply patches they generate themselves have little exposure. The sources do not say which GNU patch versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T11:17:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115207","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115207","severity":null,"published_at":"2026-10-22T11:17:50+00:00","modified_at":"2026-10-22T15:25:35+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115207","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115207","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}