CVE-2026-124584

CVSS 4.8 (medium) · published 2026-11-09

A vulnerability has been found in wummel patool 4.1.0. This vulnerability affects the function extract_gzip of the file patoolib/fileutil.py of the component Gzip Extraction Handler. The manipulation leads to symlink following. Local access is required to approach this attack. The researcher claims to have submitted a GHSA on the repository of the project.

Weakness: CWE-59, CWE-61

Source: NVD CVE-2026-124584

References

• https://github.com/wummel/patool/
• https://github.com/wummel/patool/security/advisories/GHSA-p24m-wf3f-3mf5
• https://vuldb.com/cve/CVE-2026-124584
• https://vuldb.com/submit/1038992
• https://vuldb.com/vuln/433008
• https://vuldb.com/vuln/433008/cti

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.