Bug 2547414 (CVE-2026-106057)
| Summary: | CVE-2026-106057 patool: patool: Arbitrary command execution via crafted archive filenames on Windows | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in patool. This vulnerability allows an attacker to execute arbitrary commands on Windows systems. The issue occurs because the utility fails to properly escape special characters and quotes in archive filenames before passing them to the command shell. By tricking a user or system into processing an archive with a crafted filename, an attacker can execute operating system commands with the privileges of the running patool process.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2547610 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-10-07 12:11:46 UTC
|