OESA-2026-4617: patch security update

Q: Who is exposed to this issue?

Users or automated workflows that apply patch files from untrusted or insufficiently trusted sources are exposed. Exploitation creates files with the permissions of the user account running GNU patch.

Q: What does an attacker need to exploit the flaw?

The attacker needs to entice a user or automated workflow to apply a specially crafted patch file. No attacker privileges are required, but user interaction is required to apply the patch.

Q: What is the impact of successful exploitation?

A crafted patch can cause arbitrary file creation outside the intended working directory. The affected behavior accepts absolute file paths in patch headers during automatic patch reversal.

Q: What can be done before an update is applied?

Do not apply patch files from untrusted sources, especially through automated workflows. Review patch headers for absolute paths and run patching operations with the least privileges necessary.

Published Oct 29, 2026

Updated

Patch takes a patch file containing a difference listing produced by the diff program and applies those differences to one or more original files, producing patched versions. Security Fix(es):

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.(CVE-2026-115207)

Affected Software

1 affected componentFixes available

openeuler/patch<2.7.6-17.oe2203sp4

2.7.6-17.oe2203sp4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/patch to a version that resolves this vulnerability.
Fixed in 2.7.6-17.oe2203sp4

Event History

Oct 29, 2026

Advisory Published

via OSV·09:03 AM

Data Sourced

via OSV·09:03 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-115207

Frequently Asked Questions

Who is exposed to this issue?

Users or automated workflows that apply patch files from untrusted or insufficiently trusted sources are exposed. Exploitation creates files with the permissions of the user account running GNU patch.

What does an attacker need to exploit the flaw?

The attacker needs to entice a user or automated workflow to apply a specially crafted patch file. No attacker privileges are required, but user interaction is required to apply the patch.

What is the impact of successful exploitation?

A crafted patch can cause arbitrary file creation outside the intended working directory. The affected behavior accepts absolute file paths in patch headers during automatic patch reversal.

What can be done before an update is applied?

Do not apply patch files from untrusted sources, especially through automated workflows. Review patch headers for absolute paths and run patching operations with the least privileges necessary.

OESA-2026-4617: patch security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit the flaw?

What is the impact of successful exploitation?

What can be done before an update is applied?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit the flaw?

What is the impact of successful exploitation?

What can be done before an update is applied?