CVE-2026-124584

A vulnerability has been found in wummel patool 4.1.0. This vulnerability affects the function extract_gzip of the file patoolib/fileutil.py of the component Gzip Extraction Handler. The manipulation leads to symlink following. Local access is required to approach this attack. The researcher claims to have submitted a GHSA on the repository of the project.

• CWE-59
• CWE-61

• https://github.com/wummel/patool/
• https://github.com/wummel/patool/security/advisories/GHSA-p24m-wf3f-3mf5
• https://vuldb.com/cve/CVE-2026-124584
• https://vuldb.com/submit/1038992
• https://vuldb.com/vuln/433008
• https://vuldb.com/vuln/433008/cti

Published

Nov 9, 2026

Last Modified

Nov 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-124578A security vulnerability has been detected in Pantum BP5100D…5.3
• CVE-2026-124579A vulnerability was determined in aaPanel BillionMail up to …7.4
• CVE-2026-12458Inappropriate implementation in Passwords in Google Chrome p…3.1
• CVE-2026-124580A vulnerability was found in Chengdu Feiyuxing Technology VW…10
• CVE-2026-124581A vulnerability was determined in itsourcecode Airline Reser…7.3
• CVE-2026-124582A vulnerability was identified in WebTorrent up to 2.8.5/3.0…4.3
• CVE-2026-124585A vulnerability was found in Chengdu Feiyuxing Technology VW…9.9
• CVE-2026-124586A vulnerability was determined in Tencent RapidJSON 1.1.0. I…7.3
• CVE-2026-124587A vulnerability was identified in elizaOS eliza 2.0.3-beta.7…4.3
• CVE-2026-124588A security flaw has been discovered in huggingface finetrain…6.3
• CVE-2026-124589A weakness has been identified in lxtGH OMG-Seg up to f3b26b…6.3
• CVE-2026-12459Inappropriate implementation in Serial in Google Chrome prio…6.1