DEBIAN-CVE-2026-124584: Medium severity debian/patool vulnerability
A vulnerability has been found in wummel patool 4.1.0. This vulnerability affects the function extractgzip of the file patoolib/fileutil.py of the component Gzip Extraction Handler. The manipulation leads to symlink following. Local access is required to approach this attack. The researcher claims to have submitted a GHSA on the repository of the project.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems where a local, low-privileged user can cause patool to process a gzip archive are exposed. The attack requires local access and does not require user interaction.
What access does an attacker need to exploit it?
An attacker needs local access with low privileges. The affected behavior is in patool's gzip extraction handler, where manipulation can cause symlinks to be followed.
What are the potential impacts?
The reported impact is modification of data and denial of service. No confidentiality impact is indicated by the provided severity vector.