A vulnerability in GNU patch allows an attacker to create arbitrary files outside the intended directory by using a specially crafted patch file. This occurs due to missing validation of absolute file paths during automatic patch reversal, enabling file creation with the permissions of the executing user. The flaw affects versions prior to 2.7.6-24.oe2403sp1 and has been fixed in that version.