Skip to content

GHSA-78v8-vpjp-cjqh on CTRL-OS 26.05

Aliases: GHSA-78v8-vpjp-cjqh, CVE-2026-47764

Packages: pdm

Status: In Progress

Advisory Information

InstallDestination.write_to_fs() in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces the safe _path_with_destdir() (which validates via Path.resolve() + is_relative_to()) with a bare os.path.join() that performs no path validation. A malicious wheel with traversal entries can write arbitrary files. Same class as Poetry CVE-2026-34591. Fix ready at: https://github.com/ffulbtech/pdm/tree/fix/wheel-path-traversal

Updates

2026-08-24 10:50 CEST

Metadata changes:

  • Status for package pdm: “In Progress” (5743fa9712ab8453b3afef3ed34e096a750bb9b9)

2026-08-24 10:50 CEST

Metadata changes:

  • Status for package pdm: “New”