CVE-2026-115207— Patch: filename validation bypass in reversal fallback allows file creation outside the working directory
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 GNU patch 中发现了一个安全漏洞。攻击者可通过诱使用户或自动化工作流应用特制的补丁文件，从而在预期工作目录之外创建任意文件。该漏洞的成因是：在执行自动补丁回退时缺少必要的验证机制，导致补丁头部中的绝对文件路径被接受而非被拒绝。因此，该工具能够以执行用户的权限，在任意位置创建文件。
Possible ATT&CK Techniques 1 AI
T1105 · Ingress Tool Transfer
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-115207
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Patch: filename validation bypass in reversal fallback allows file creation outside the working directory
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Hardened Images | - |
cpe:/a:redhat:hummingbird:1
|
|
II. Public POCs for CVE-2026-115207
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-115207
请登录查看更多情报信息。
Other References for CVE-2026-115207 (2)
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-111079
Goose: goose: shell history and environment leak via termina -
CVE-2026-85518
Openscap: openscap: arbitrary file write via path traversal -
CVE-2026-92824
Libmodulemd: libmodulemd: out-of-bounds read when emitting r -
CVE-2026-92823
Libmodulemd: libmodulemd: missing decompressed-size limit wh -
CVE-2026-92822
Libmodulemd: libmodulemd: unbounded recursion when parsing n
Same vendor: Red Hat
-
CVE-2026-111079
Goose: goose: shell history and environment leak via termina -
CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificat -
CVE-2026-85518
Openscap: openscap: arbitrary file write via path traversal -
CVE-2026-114438
Keycloak-services: keycloak-services: required otp enrollmen -
CVE-2026-110744
Multicluster-global-hub-operator-bundle: operator serviceacc
Same weakness: CWE-22
-
CVE-2024-58396
YouDataSum CPAS Audit Management System V4 Path Traversal vi -
CVE-2022-51025
Penta Security WAPPLES 4.0.54.1 / 5.0 / 6.0 Path Traversal v -
CVE-2022-51024
Kavita < 0.5.4.1 Unauthenticated Path Traversal via cover-up -
CVE-2022-51022
YiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFi -
CVE-2021-48017
OrbiTeam BSCW Server < 5.2.5 / 7.4.4 Path Traversal via bscw
V. Comments for CVE-2026-115207
No comments yet