CVE-2026-47764highCWE-22

CVE-2026-47764: falha de alta gravidade em pdm-project pdm

pdm: Path traversal in wheel installation via overridden write_to_fs

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar pdm+ Monitorar pdm

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.4epss 0.2%
pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through write_to_fs. InstallDestination.write_to_fs() in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces the safe _path_with_destdir() (which validates via Path.resolve() + is_relative_to()) with a bare os.path.join() that performs no path validation. A malicious wheel with traversal entries can write arbitrary files. This issue has been fixed in version 2.27.0.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
pdm-project · pdm
CVEs relacionadas — pdm-project pdm

No mesmo produto, das mais perigosas para as menos.

CVE-2023-45805HIGHTrojan Lockfilein pdmEPSS 0.5%CVE-2026-47763MEDIUMpdm: Project-Local State and Config Writes Follow SymlinksEPSS 0.2%CVE-2026-47781HIGHpdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI ParsingEPSS 0.2%