CVE-2026-124584

4.4 MEDIUMpublic exploit available

Published 2026-11-09 · Updated 2026-11-09

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

A vulnerability has been found in wummel patool 4.1.0. This vulnerability affects the function extract_gzip of the file patoolib/fileutil.py of the component Gzip Extraction Handler. The manipulation leads to symlink following. Local access is required to approach this attack. The researcher claims to have submitted a GHSA on the repository of the project.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weaknesses

CWE-59, CWE-61

Public exploit & PoC references

https://github.com/wummel/patool/
https://github.com/wummel/patool/security/advisories/GHSA-p24m-wf3f-3mf5

All references

https://github.com/wummel/patool/
https://github.com/wummel/patool/security/advisories/GHSA-p24m-wf3f-3mf5
https://vuldb.com/cve/CVE-2026-124584
https://vuldb.com/submit/1038992
https://vuldb.com/vuln/433008
https://vuldb.com/vuln/433008/cti

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

UNSCOREDCVE-2026-100395PoC
MEDIUMCVE-2026-106507PoC
HIGHCVE-2026-107810PoC
HIGHCVE-2026-115908PoC
HIGHCVE-2026-119336PoC
MEDIUMCVE-2026-121747PoC
HIGHCVE-2026-100419PoC
HIGHCVE-2026-100690PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.