CVE-2010-4651: GNU Patch

Medium severity, CVSS 5.8. EPSS: 4.9% chance of exploitation in the next 30 days.

Directory traversal vulnerability in util.c in GNU patch 2.6.1 and earlier allows user-assisted remote attackers to create or overwrite arbitrary files via a filename that is specified with a .. (dot dot) or full pathname, a related issue to CVE-2010-1679.

Affected products

• GNU GNU Patch: up to and including 2.6.1; version 2.5 only; version 2.5.4 only; version 2.5.9 only; version 2.6 only

Published 2011-03-11. Last modified 2026-06-16.