Symlink Following Vulnerability in wummel Patool Gzip Extraction Handler
CVE-2026-124584

4.8MEDIUM

Key Information:

Vendor

Wummel

Status
Patool
Vendor
CVE Published:
9 November 2026

What is CVE-2026-124584?

In wummel Patool version 4.1.0, a vulnerability has been identified in the extract_gzip function located in the file patoolib/fileutil.py. This vulnerability enables an attacker with local access to exploit symlink following, allowing them to manipulate how files are handled during Gzip extraction. The issue arises due to improper handling of symbolic links, potentially leading to unexpected file access or data manipulation.

Affected Version(s)

patool 4.1.0

References

https://vuldb.com/vuln/433008
vdb-entrytechnical-description
https://vuldb.com/vuln/433008/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-124584
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Vu Hoang Dat
Le Quang Minh
Vu Hoang Dat (VulDB User)
Vu Hoang Dat (VulDB User)
VulDB CNA Team
.