Skip to content
OpenAdvisories

Package · Ubuntu

patool

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 4.4
    CVE-2026-124584

    wummel patool Gzip Extraction fileutil.py extract_gzip symlink

    A vulnerability has been found in wummel patool 4.1.0. This vulnerability affects the function extract_gzip of the file patoolib/fileutil.py of the component Gzip Extraction Handler. The manipulation leads to symlink following. Local access is required to app…

    wummel patool patool patool Debian Ubuntu
  • High 7.8
    CVE-2026-106057

    patool before 4.0.6 OS Command Injection on Windows via shell_quote_nt

    patool before 4.0.6 contains an OS command injection vulnerability on Windows because shell_quote_nt fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-f…

    wummel patool patool Ubuntu
  • Medium 5.4
    CVE-2026-29509

    Patool < 4.0.5 Path Traversal via safe_extract() Function

    Patool before 4.0.5 contains a path traversal vulnerability in the safe_extract() function in patoolib/programs/py_tarfile.py when running on Python before 3.12, where the is_within_directory() helper uses os.path.commonprefix() for character-level string com…

    wummel patool patool patool Debian Ubuntu