The flaw appears in the extract_gzip function of patool's fileutil module. By supplying an adversarial .gz payload, an attacker can cause the handler to follow symbolic links. This allows reading arbitrary local files that the executing user has permission to access. The vulnerability does not grant network-level elevation or arbitrary code execution; it is limited to the local file system.

wummel:patool 4.1.0 is affected. No other versions are listed as vulnerable. The issue resides in the Gzip Extraction Handler component of the patool library.

The CVSS score of 4.8 indicates moderate impact. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local access, meaning a user on the same host or a compromised process executing patool can abuse the flaw. Exploitation requires crafting a malicious gzip file that points to a symlink, then invoking extract_gzip. Because the attack remains local, the overall threat is confined to environments that allow local users to run or modify patool.