CVE-2026-115207 — Patch: filename validation bypass in reversal fallback allows file creation outside the working directory

A flaw in GNU patch allows an attacker to create files outside the intended working directory by getting a user or automated workflow to apply a specially crafted patch file.