CVE-2026-115207

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Oct 22, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A common tool used to apply software updates can be tricked into creating or changing files anywhere on the computer if someone applies a specially made update file.

Exploitation: Requires User Interaction
Attacker needs: User Interaction
Complexity: Low
Impact: Data Tampering
Component: Application
Class: Path Traversal
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

Missing validation of absolute paths in patch headers during automatic reversal allows the GNU patch utility to write files to arbitrary locations outside the working directory using the permissions of the invoking user.

Why it matters to the business

Attackers can create or overwrite files in privileged locations, potentially leading to system compromise, data tampering, or persistence if users or automated workflows apply untrusted patches; the issue affects a widely used utility with high ecosystem prevalence.

How an attack unfolds

An attacker crafts a patch file containing an absolute path header (for example targeting /etc/cron.d or a user-writable binary location), then entices a victim to apply the patch; during reversal processing the absolute path is honored instead of rejected, resulting in arbitrary file creation.

How to fix it

Upgrade GNU patch to the latest vendor release that enforces rejection of absolute paths; until fixed versions are available, avoid applying patches from untrusted sources and run patch with minimal privileges inside restricted directories.

How to confirm the fix worked

Confirm the installed patch version rejects absolute paths during reversal; test by attempting to apply a crafted patch containing an absolute path header and verify the operation is blocked or fails safely.

Typical attack path

Craft a malicious patch containing absolute file paths in the header
Deliver the patch via email, download link, or repository to a target user or CI/CD workflow
Victim invokes patch (including reversal mode) on the file
Arbitrary file is written to the attacker-chosen location with user privileges

How to detect it

Review patch command logs and process execution history for invocations involving reversal flags combined with files containing absolute paths; correlate with unexpected file creation or modification timestamps in system directories.

What your security team should do

Prioritize updating GNU patch across all systems once a fixed release is published
Implement policy requiring review or sandboxing of any externally sourced patch files
Monitor EPSS and KEV status for changes indicating increased exploitation risk
Educate developers and operations staff on the risks of applying untrusted patches

The record

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.

Affected packages

Ecosystem	Package	Introduced	Fixed