CVE-2026-124584

MEDIUM 4.4

wummel patool Gzip Extraction fileutil.py extract_gzip symlink

CVSS Score

4.4

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability has been found in wummel patool 4.1.0. This vulnerability affects the function extract_gzip of the file patoolib/fileutil.py of the component Gzip Extraction Handler. The manipulation leads to symlink following. Local access is required to approach this attack. The researcher claims to have submitted a GHSA on the repository of the project.

CWE	CWE-61 CWE-59
Vendor	wummel
Product	patool
Published	Nov 9, 2026
Last Updated	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for wummel patool

Be the first to know when new medium vulnerabilities affecting wummel patool are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

wummel / patool

4.1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/433008 vuldb.com: https://vuldb.com/vuln/433008/cti vuldb.com: https://vuldb.com/cve/CVE-2026-124584 vuldb.com: https://vuldb.com/submit/1038992 github.com: https://github.com/wummel/patool/security/advisories/GHSA-p24m-wf3f-3mf5 github.com: https://github.com/wummel/patool/

Credits

Vu Hoang Dat (VNU Information Technology Institute, Vietnam National University, Hanoi) Le Quang Minh (VNU Information Technology Institute, Vietnam National University, Hanoi) 🔍 Vu Hoang Dat (VulDB User) Vu Hoang Dat (VulDB User) VulDB CNA Team