CVE-2026-115207 Patch: filename validation bypass in reversal fallback allows file creation outside the working directory
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-115207?
CVE-2026-115207 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, published on 22 Oct 2026.
Official description
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.
Weakness: CWE-22
Which versions are affected by CVE-2026-115207?
Linux distribution packages (1)
patch openSUSE:Tumbleweed | All versions | 2.8.1-1.1 |
How do I fix CVE-2026-115207?
Upgrade to a fixed version.
Is CVE-2026-115207 being exploited?
There is no known exploitation of CVE-2026-115207 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-115207, ECHO-63dc-00f6-c1c4, GHSA-m74w-h57v-xv36, OESA-2026-4617, OESA-2026-4618, OESA-2026-4619 and 3 more.