A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or… (CVE-2026-115207)

CVE-2026-115207 describes a flaw in GNU patch where absolute file paths in patch headers are not properly validated during automatic patch reversal. This allows an attacker to achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a crafted patch file. The created files inherit the permissions of the user executing the patch utility. The vulnerability is classified under CWE-22 (Path Traversal).

An attacker can create files arbitrarily on the filesystem outside the working directory with the permissions of the executing user. This could lead to unauthorized file creation and potential integrity issues. There is no direct confidentiality or availability impact reported. Exploitation requires user interaction to apply the malicious patch.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid applying untrusted patch files and verify patch contents before application.