Arbitrary File Creation Vulnerability in GNU Patch by Red Hat
CVE-2026-115207

5.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
22 October 2026

What is CVE-2026-115207?

A vulnerability exists in GNU Patch that allows attackers to create arbitrary files outside the intended directory. This issue arises from insufficient validation during automatic patch reversal processes. Attackers can exploit this flaw by persuading users or automated systems to apply a maliciously crafted patch file. The utility accepts absolute file paths in patch headers, leading to potential unauthorized file creation with the permissions of the user running the patch command.

References

https://access.redhat.com/security/cve/CVE-2026-115207
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2558775
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Calif.io for reporting this issue.
.