An update for patch is now available for openEuler-22.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4617 Final 1.0 1.0 2026-10-29 Initial 2026-10-29 2026-10-29 openEuler SA Tool V1.0 2026-10-29 patch security update An update for patch is now available for openEuler-22.03-LTS-SP4 Patch takes a patch file containing a difference listing produced by the diff program and applies those differences to one or more original files, producing patched versions. Security Fix(es): A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.(CVE-2026-115207) An update for patch is now available for openEuler-22.03-LTS-SP4. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium patch https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4617 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-115207 https://nvd.nist.gov/vuln/detail/CVE-2026-115207 openEuler-22.03-LTS-SP4 patch-2.7.6-17.oe2203sp4.x86_64.rpm patch-debuginfo-2.7.6-17.oe2203sp4.x86_64.rpm patch-debugsource-2.7.6-17.oe2203sp4.x86_64.rpm patch-help-2.7.6-17.oe2203sp4.noarch.rpm patch-2.7.6-17.oe2203sp4.aarch64.rpm patch-debuginfo-2.7.6-17.oe2203sp4.aarch64.rpm patch-debugsource-2.7.6-17.oe2203sp4.aarch64.rpm patch-2.7.6-17.oe2203sp4.src.rpm A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user. 2026-10-29 CVE-2026-115207 openEuler-22.03-LTS-SP4 Medium 5.5 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N patch security update 2026-10-29 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4617