patool EUVD-2026-94305

Requires patool before 4.0.6 running on a Windows host (the flaw is in the Windows-specific shell_quote_nt quoting function) and processing of an archive whose filename the attacker controls. The vulnerable code path is a single-file archive format (e.g. .gz) invoked with shell=True, where the crafted filename (e.g. report&calc.gz) is passed to cmd.exe without escaping of metacharacters (^:&|<>()"!) or embedded double quotes. Limiting factors: exploitation is Windows-only, requires the victim to actively run patool against the attacker-supplied file (passive user interaction), and is confined to code paths that invoke the shell for single-file formats; non-Windows platforms and formats not using shell=True are unaffected. Command execution is bounded by the privileges of the patool process.

The provided CVSS 4.0 base score of 8.5 (High) reflects full confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) from arbitrary command execution, but the vector is local (AV:L) and requires passive user interaction (UI:P) - a victim must run patool against an attacker-supplied archive on Windows. This is NOT a remotely-triggerable, wormable flaw despite the high score; it is weighted up by impact rather than ease of mass exploitation. No EPSS probability was supplied, the CVE is not in CISA KEV, and no public exploit code was indicated in the data, so this is: no public exploit identified at time of analysis. The description provides a concrete working payload concept (report&calc.gz), which lowers the barrier to developing an exploit, but exploitation realistically depends on social engineering (delivering a maliciously-named archive) and the target processing single-file formats with shell=True on Windows. Net assessment: a genuine high-severity code-execution bug that is real but not urgent for most environments - prioritize for Windows systems or automated pipelines that unpack untrusted archives via patool, deprioritize elsewhere. A vendor patch exists, making remediation straightforward.

An attacker crafts an archive with a malicious filename such as report&calc.gz and delivers it to a victim (email, download, shared folder). When the victim uses patool < 4.0.6 on Windows to extract or inspect the file - triggering a single-file-format handler that runs with shell=True - the unescaped cmd.exe metacharacters in the filename are interpreted as commands and execute with the privileges of the patool process. No public proof-of-concept was identified in the provided data, though the advisory describes the payload pattern.