A vulnerability in GNU patch allows an attacker to create arbitrary files outside the intended directory by using a specially crafted patch file. This occurs because the patch utility accepts absolute file paths in patch headers during automatic patch reversal without proper validation. The flaw can lead to arbitrary file creation with the permissions of the user executing the patch command. A fix is available in version 2.7.6-24.oe2403sp3.