CVE-2026-115207 in patch
Summary
by MITRE • 10/22/2026
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified within GNU Patch represents a significant security risk related to path traversal and improper input validation. This flaw allows an attacker to achieve arbitrary file creation outside the intended working directory by leveraging specially crafted patch files. The core technical issue stems from missing validation during automatic patch reversal operations, where absolute file paths present in patch headers are accepted rather than being rejected or sanitized. In a typical scenario, users apply patches using commands such as reverse-patch which attempts to undo changes made by an original patch. If the reversed patch contains references to absolute paths like /etc/passwd or other sensitive system locations, GNU Patch will proceed to create or modify files at those specific locations without verifying that they reside within the expected directory structure.
This behavior creates a direct pathway for privilege escalation and data integrity compromise depending on the context in which the tool is executed. When an automated workflow applies such a maliciously crafted patch, it may run with elevated privileges, allowing the attacker to write files into system directories or overwrite critical configuration files. Even when applied by a standard user, this vulnerability can lead to unauthorized file creation that might interfere with other applications or serve as a foothold for further exploitation attempts. The ability to create files in arbitrary locations undermines the fundamental assumption of sandboxing and directory isolation that many build systems and deployment pipelines rely upon for security.
From an industry standards perspective, this flaw aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, also known as path traversal. The lack of validation against absolute paths in patch headers exemplifies how input data is not sufficiently constrained before being processed by the application logic. Furthermore, if exploited within automated CI/CD pipelines or deployment scripts, this vulnerability can be mapped to ATT&CK techniques involving command and script interception or file manipulation for persistence and impact. Attackers often use such vulnerabilities as part of supply chain attacks where trusted tools are manipulated via malicious inputs distributed through compromised repositories or phishing campaigns targeting developers who frequently apply patches from untrusted sources.
The operational impact extends beyond simple file creation, potentially leading to denial of service if critical system files are overwritten with incorrect content, or remote code execution if the created files contain executable scripts that are later triggered by other processes. In environments where GNU Patch is used extensively for managing source code updates across multiple projects, this vulnerability poses a systemic risk because it affects any workflow that automatically applies patches without manual review of their contents. The severity is heightened in containerized or cloud-native environments where patching operations might occur with root privileges to ensure compatibility and proper permission settings during deployment phases.
Mitigation strategies must focus on both immediate remediation and long-term defensive measures. Users should immediately update GNU Patch to the latest version available from official repositories, as vendors typically release patches addressing these validation gaps in subsequent releases. Until an updated version is deployed, administrators can implement workarounds such as restricting file system permissions so that even if arbitrary files are created, they cannot be executed or overwrite critical system binaries. Additionally, integrating static analysis tools and linters into CI/CD pipelines to scan incoming patch files for suspicious patterns like absolute paths before application can provide an additional layer of defense. Security teams should also enforce strict code review policies requiring manual verification of any externally sourced patches, particularly those involving changes to configuration or system-level directories. Regular auditing of automated workflows ensures that no untrusted input is processed without adequate sanitization checks in place.