Patch: filename validation bypass in reversal fallback allows file creation outside the working directory
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
GNU patch, the utility used to apply changes from diff files to source code, is affected by this vulnerability. An attacker could trick a user or automated process into applying a specially crafted patch so that files are created in arbitrary locations outside the working directory, with the privileges of the user running the tool.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- patch
Version range not reported
- patch
Version range not reported
- patch
Version range not reported
- patch
Version range not reported
- patch
Version range not reported
- patch
Version range not reported