CVE-2026-124584 · Package
NO FIX YET
patool 4.1.0, a Python archive extraction tool, follows symlinks in the extract_gzip function of patoolib/fileutil.py. A local attacker can use a crafted gzip archive to make extraction touch files outside the intended directory.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run patool 4.1.0 to extract gzip archives, especially from untrusted sources. The attack needs local access to supply or place the archive, so a server that only extracts trusted, internally built archives is lower risk. unknown whether other versions are affected.
Not affected if different-version, no-untrusted-archives
Who cares patool, python
pip show patool and see whether it is 4.1.0.No fix yet, per the sources.
A vulnerability has been found in wummel patool 4.1.0. This vulnerability affects the function extract_gzip of the file patoolib/fileutil.py of the component Gzip Extraction Handler. The manipulation leads to symlink following. Local access is required to approach this attack. The researcher claims to have submitted a GHSA on the repository of the project.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.