A vulnerability in GNU patch allows an attacker to create arbitrary files outside the intended directory by using specially crafted patch files containing absolute paths. This occurs due to missing validation during automatic patch reversal, permitting absolute file paths in patch headers. The flaw can lead to arbitrary file creation with the permissions of the user applying the patch. A fix is available in version 2.7.6-17.oe2203sp4.