Moyenne
5.5
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the...
CVE-2026-115207
Première détection SecPulse
Paquets affectés
| Écosystème | Paquet | Concernées | Corrigé |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
Description d'origine La description telle que publiée par la source (souvent en anglais).
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
Références
- web access.redhat.com
- web bugzilla.redhat.com
- web nvd.nist.gov
- web github.com