PT-2026-107482

CVE-2026-106057

Published

2026-10-07

Updated

2026-11-05

Description by

CVSS 4.0

8.5

High

MetricsAV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions patool versions prior to 4.0.6

Description An OS command injection issue exists on Windows when the shell quote nt function fails to properly escape cmd.exe metacharacters or embedded double quotes within archive filenames. This allows attackers to execute arbitrary commands with the privileges of the patool process by providing specially crafted filenames, such as report&calc.gz, for single-file formats executed with shell=True.

Recommendations Update patool to version 4.0.6 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Muhammad Sobirov

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

Related identifiers