From ca3498b029825663f5f0b65cf5cba78eaa78fcd4 Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Mon, 20 Jul 2026 10:37:34 +0200
Subject: [PATCH] sssd: patch CVE-2026-14476

Backport the upstream 2.13 fix that rejects path traversal in gPCFileSysPath before GPO cache paths are constructed.

Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol)
(cherry picked from commit ee4b7e100e8842d83a20fc52d12b8cc3ad827804)
---
 pkgs/by-name/ss/sssd/package.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/ss/sssd/package.nix b/pkgs/by-name/ss/sssd/package.nix
index c9d89133e736..ce7edc010cec 100644
--- a/pkgs/by-name/ss/sssd/package.nix
+++ b/pkgs/by-name/ss/sssd/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
   autoreconfHook,
   makeWrapper,
   glibc,
@@ -78,6 +79,13 @@ stdenv.mkDerivation (finalAttrs: {
     # Keep in mind to check /src/external/pac_responder.m4 for Kerberos compatibility before update Kerberos !!!
     # Fix Kerberos Support version for PAC responder
     #./fix-kerberos-version.patch
+
+    # Remove once a release containing this upstream fix is packaged.
+    (fetchpatch2 {
+      name = "CVE-2026-14476.patch";
+      url = "https://github.com/SSSD/sssd/commit/ba207eab76ff5253662a763b9b6e9ea42f03d31b.patch?full_index=1";
+      hash = "sha256-55V8RfIcGF49GGebg+pgCLPU9MGY2S/7PaOGIqwNL0w=";
+    })
   ];
 
   postPatch = ''