CVE-2026-115207
Patch: filename validation bypass in reversal fallback allows file creation outside the working directory
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Patch: filename validation bypass in reversal fallback allows file creation outside the working directory
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.
- Record
CVE-2026-115207- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-05
EUVDEUVD-2026-108112
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.
- Record
EUVD-2026-108112- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-m74w-h57v-xv36
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the...
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.
- Record
GHSA-m74w-h57v-xv36- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.
- Record
CVE-2026-115207- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-05
OSVBELL-CVE-2026-115207
- Record
BELL-CVE-2026-115207- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-04
OSVDEBIAN-CVE-2026-115207
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.
- Record
DEBIAN-CVE-2026-115207- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 7 moreShow less
OSVOESA-2026-4617
patch security update
Patch takes a patch file containing a difference listing produced by the diff program and applies those differences to one or more original files, producing patched versions.
Security Fix(es):
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.(CVE-2026-115207)
- Record
OESA-2026-4617- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVOESA-2026-4618
patch security update
Patch takes a patch file containing a difference listing produced by the diff program and applies those differences to one or more original files, producing patched versions.
Security Fix(es):
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.(CVE-2026-115207)
- Record
OESA-2026-4618- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVOESA-2026-4619
patch security update
Patch takes a patch file containing a difference listing produced by the diff program and applies those differences to one or more original files, producing patched versions.
Security Fix(es):
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.(CVE-2026-115207)
- Record
OESA-2026-4619- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVOESA-2026-4620
patch security update
Patch takes a patch file containing a difference listing produced by the diff program and applies those differences to one or more original files, producing patched versions.
Security Fix(es):
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.(CVE-2026-115207)
- Record
OESA-2026-4620- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-115207
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.
- Record
UBUNTU-CVE-2026-115207- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVAZL-112121 No score
CVE-2026-115207 affecting package patch 2.7.6-10
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.
- Record
AZL-112121- Updated
- 2026-11-05
OSVopenSUSE-SU-2026:12302-1 No score
patch-2.8.1-1.1 on GA media
These are all security issues fixed in the patch-2.8.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12302-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
patchAzure Linux:3 |
through 2.7.6-10 | None known |
patchAlpaquita:23 |
2.7.6-r8 up to 2.7.6-r11 | 2.7.6-r11 |
patchAlpaquita:25 |
2.8-r0 up to 2.8.1-r0 | 2.8.1-r0 |
patchBellSoft Hardened Containers:23 |
2.7.6-r8 up to 2.7.6-r11 | 2.7.6-r11 |
patchBellSoft Hardened Containers:25 |
2.8-r0 up to 2.8.1-r0 | 2.8.1-r0 |
patchDebian:12 |
All versions, plus listed versions 2.7.6-72.8-12.8-22.8.1-1 |
None known |
patchDebian:13 |
All versions, plus listed versions 2.8-22.8.1-1 |
None known |
patchDebian:14 |
before 2.8.1-1, plus listed versions 2.8-2 |
2.8.1-1 |
patchopenEuler:22.03-LTS-SP4 |
before 2.7.6-17.oe2203sp4 | 2.7.6-17.oe2203sp4 |
patchopenEuler:24.03-LTS-SP1 |
before 2.7.6-24.oe2403sp1 | 2.7.6-24.oe2403sp1 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
patchopenEuler:24.03-LTS-SP3 |
before 2.7.6-24.oe2403sp3 | 2.7.6-24.oe2403sp3 |
patchopenEuler:24.03-LTS-SP4 |
before 2.7.6-24.oe2403sp4 | 2.7.6-24.oe2403sp4 |
patchUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 2.7.1-32.7.1-42.7.1-4ubuntu12.7.1-4ubuntu22.7.1-4ubuntu2.32.7.1-4ubuntu2.42.7.1-4ubuntu2.4+esm1 |
None known |
patchUbuntu:16.04:LTS |
All versions, plus listed versions 2.7.5-12.7.5-1ubuntu0.16.04.12.7.5-1ubuntu0.16.04.2 |
None known |
patchUbuntu:18.04:LTS |
All versions, plus listed versions 2.7.5-1build12.7.6-12.7.6-2ubuntu12.7.6-2ubuntu1.1 |
None known |
patchUbuntu:20.04:LTS |
All versions, plus listed versions 2.7.6-6 |
None known |
patchUbuntu:22.04:LTS |
All versions, plus listed versions 2.7.6-72.7.6-7build12.7.6-7build2 |
None known |
patchUbuntu:24.04:LTS |
All versions, plus listed versions 2.7.6-7build22.7.6-7build3 |
None known |
patchUbuntu:26.10 |
All versions, plus listed versions 2.8-2build1 |
None known |
patchUbuntu:26.04:LTS |
All versions, plus listed versions 2.8-22.8-2build1 |
None known |
patchopenSUSE:Tumbleweed |
before 2.8.1-1.1 | 2.8.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| affected, aliases, references | EUVD, OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-115207 is a medium vulnerability (CVSS 5.5) in Red Hat Enterprise Linux 10, published October 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in patch 2.7.6-r11.
References
access.redhat.com/security/cve/CVE-2026-115207
bugzilla.redhat.com/show_bug.cgi?id=2558775
openwall.com/lists/oss-security/2026/10/26/14
nvd.nist.gov/vuln/detail/CVE-2026-115207
github.com/advisories/GHSA-m74w-h57v-xv36
docs.bell-sw.com/security/cves/CVE-2026-115207
Show 8 moreShow less
security-tracker.debian.org/tracker/CVE-2026-115207
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-4617
ubuntu.com/security/CVE-2026-115207
cve.org/CVERecord?id=CVE-2026-115207
suse.com/security/cve/CVE-2026-115207