GNU patch CVE-2026-115207

Exploitation requires a victim user or an automated workflow (such as a CI/CD or build pipeline) to apply an attacker-controlled patch file with GNU patch; the flaw specifically triggers during automatic patch reversal, where an absolute file path placed in the patch header is accepted instead of rejected, allowing file creation outside the intended working directory. Limiting factors: the attack vector is local (AV:L) and requires user interaction (UI:R) - the attacker cannot initiate it remotely and must get the crafted patch applied; impact is confined to arbitrary file creation (integrity only, I:H) with the permissions of the executing user, with no confidentiality or availability impact and no privilege escalation beyond that user's existing rights.

This is a moderate, not emergency, priority. The CVSS 3.1 base score is 5.5 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - a LOCAL attack vector that depends on user interaction (a victim or automated workflow applying an attacker-supplied patch), with impact limited to integrity (arbitrary file creation) and no confidentiality or availability loss. No EPSS score, no CISA KEV listing, and no PoC or exploit reference are present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today Decision label is 'this_month', which aligns with the signals: a credible integrity flaw in a very common utility, but gated behind the social/workflow step of getting a crafted patch applied and limited to the executing user's permissions. Note the PR:N/UI:R combination: the CVSS records no required privileges yet mandates user interaction, so exploitation is 'unauthenticated' in the formal sense but is not attacker-initiated - it hinges on tricking a user or pipeline. The trigger mechanism (missing validation of absolute paths during automatic patch reversal) is described in the source; the conditions under which automatic reversal occurs are not further detailed in the available data and should be confirmed with the Red Hat/GNU advisory.

An attacker crafts a patch file whose header contains an absolute path and distributes it (e.g., via a pull request, shared archive, or dependency) so that a developer or a CI/CD pipeline applies it with GNU patch. Because validation is missing during automatic patch reversal, the absolute path is accepted and a file is written to an arbitrary location with the permissions of the user running patch. No public exploit code or PoC reference is present in the supplied data.