Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in GNU patch. The reversal fallback in intuit_diff_type() in src/pch.c selects a filename from the patch headers without applying the name_is_valid() check that normally rejects absolute paths. A crafted unified diff that appears to delete a nonexistent file, with an absolute filename in both headers and an epoch timestamp for the new file, can trigger automatic reversal when applied with patch -p0 -t. The unvalidated absolute filename reaches the filesystem operations, allowing attacker-controlled file creation outside the working directory with the permissions of the account running patch. Exploitation requires a user or workflow to apply the crafted patch; it does not bypass operating-system filesystem permissions.