A flaw in the GNU patch utility allows an attacker to create files outside the intended working directory. The flaw exists because patch does not validate absolute paths in the patch headers when automatically reversing changes, so an attacker can supply a patch file containing an absolute path in a header line. When applied, patch creates the file at that path with the permissions of the user running the patch command, enabling the attacker to write arbitrary files and potentially overwrite critical system or application files.

The vulnerability affects Red Hat products that ship with GNU patch, including Red Hat Enterprise Linux 10, 9, 8, 7, 6, and Red Hat Hardened Images, as well as Red Hat Hummingbird version 1, which is used across multiple platforms. Systems running the affected patch versions are susceptible if they process untrusted patch files.

The CVSS score of 5.5 indicates a moderate severity. No EPSS score is available, but the KEV catalog does not list this vulnerability. Exploitation requires an attacker to cause a user or automated workflow to apply a specially crafted patch. The attack is local; it does not provide remote code execution but can lead to integrity problems by writing files with the executing user’s privileges. Careful control of patch files and execution contexts is essential to mitigate this risk.