UBUNTU-CVE-2026-124584: Medium severity ubuntu/patool vulnerability
A vulnerability has been found in wummel patool 4.1.0. This vulnerability affects the function extractgzip of the file patoolib/fileutil.py of the component Gzip Extraction Handler. The manipulation leads to symlink following. Local access is required to approach this attack. The researcher claims to have submitted a GHSA on the repository of the project.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems using Ubuntu's patool package are exposed when a local user can invoke the gzip extraction functionality. The attack requires local access and low privileges.
What does an attacker need to exploit it?
An attacker needs local access and the ability to manipulate conditions affecting patool's Gzip Extraction Handler. No user interaction is required.
What is the impact of successful exploitation?
Successful exploitation can cause patool to follow a symlink during gzip extraction. The reported impact includes low integrity and availability effects, with no confidentiality impact indicated.